19. A computer-implemented method of evaluating an electronic mail message based on probabilistic analysis, comprising: training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold.
21. The invention of claim 19 , further comprising: extracting a domain name portion of the third network resource identifier; retrieving one or more MX records for the domain name portion from a domain name system (DNS) server; retrieving network address records for each mail exchange that is identified in the one or more MX records; determining an average reputation score for the network address records; adding the third network resource identifier to the blocklist when the average reputation score is less than a specified threshold.