So we would filter the one Tor domain? Directly using IP is a problem for the spammer moreso than it is the network.

Maybe I’m missing something here but you’ve not explained why this wouldn’t work, you’ve just given more things that I’d want to filter out.