11. A data processing system, comprising: means for training a probabilistic filter using first properties of one or more first network resource identifiers obtained from a whitelist; wherein at least one of the first properties is obtained from any of: information obtained from DNS queries based, at least in part, on the one or more first work resource identifiers; server software information; or information obtained from “whois” queries based, at least in part, on information contained in the network resource identifier; means for training the probabilistic filter using second properties of one or more second network resource identifiers obtained from a blocklist; means for testing third properties of a third network resource identifier using the probabilistic filter, resulting in creating a probability output; means for adding the third network resource identifier to the blocklist when the probability output is greater than a specified threshold.
18. The invention of claim 11 , further comprising: one or more messaging gateways coupled to the processor over a data network; means for communicating the blocklist to the one or more messaging gateways over the data network; means for receiving a message containing one or more hyperlinks or network resource identifiers; means for searching the received blocklist to determine whether the one or more hyperlinks or network resource identifiers are in the blocklist; means for modifying a spam score value of the message based on whether the one or more hyperlinks or network resource identifiers are in the blocklist.