Method for identifying and filtering unsolicited bulk email

• US 20070143469A1
• Filed: 12/16/2005
• Published: 06/21/2007
• Est. Priority Date: 12/16/2005
• Status: Abandoned Application

• Current Assignee: Greenview Data, Inc. (Open Text Corporation)
• Original Assignee: Greenview Data, Inc. (Open Text Corporation)
• Inventors: Adams, Mark, Green, Philippe-Jacques, Green, Theodore
• Application Number:
  US11/305,744
• Publication Number:
  US 20070143469A1
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 51/56 Unified messaging, e.g. interactions between e-mail, instant messaging or converged IP messaging [CPM]

Abstract

An improved method is provided for identifying unsolicited bulk email messages. The method includes: monitoring electronic messages being sent to a plurality of recipients; identifying a subset of the electronic messages advertising a particular domain name; assessing reputation of the particular domain name; determining how many recipients received an electronic message from the subset of electronic messages; and deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name is not reputable and the number of recipients receiving an electronic message from the subset of electronic messages exceeds a threshold.

Claims

1. A method of identifying unsolicited bulk email messages, comprising:

monitoring electronic messages being sent to a plurality of recipients;

identifying a subset of the electronic messages advertising a particular domain name;

assessing reputation of the particular domain name;

determining how many recipients received an electronic message from the subset of electronic messages; and

deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name is not reputable and the number of recipients receiving an electronic message from the subset of electronic messages exceeds a frequency threshold.

2. The method of claim 1 further comprises blocking the subset of electronic messages from reaching intended recipients.

3. The method of claim 1 wherein assessing reputation of the particular domain name further comprises determining how recently the particular domain name was registered with a domain name registrar.

4. The method of claim 3 further comprises deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name advertised in the subset of electronic messages has been registered within a period of time and the number of recipients receiving an electronic message from the subset of electronic messages exceeds a frequency threshold.

5. The method of claim 1 wherein assessing reputation of the particular domain name further comprises determining an IP address for the particular domain name and comparing the IP address to a list of known non-reputable IP addresses.

6. The method of claim 1 wherein assessing the reputation of the particular domain name further comprises retrieving a web page associated with the particular domain name, determining a signature based on content of the web page, and comparing the signature to a compilation of signatures for web pages associated with known spammers.

7. The method of claim 1 wherein assessing reputation of the particular domain name further comprises determining a domain name server associated with the particular domain name and comparing the domain name server to a list of known non-reputable domain name servers.

8. The method of claim 1 further comprises determining how many recipients received an electronic message from the subset of electronic messages within a period of time.

9. The method of claim 1 further comprises determining how many different groups of associated recipients received an electronic message from the subset of electronic messages, where the plurality of recipients are grouped into groups of associated recipients, and deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name is not reputable and the number of different groups receiving an electronic message from the subset of electronic messages exceeds a frequency threshold.

10. A method of identifying unsolicited bulk email messages, comprising:

monitoring electronic messages being sent to a plurality of recipients;

identifying a subset of the electronic messages advertising a particular domain name;

determining if the particular domain name was registered with a domain name registrar within a period of time;

determining how many recipients received an electronic message from the subset of electronic messages; and

deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name advertised in the subset of electronic messages has been registered within the defined period of time and the number of recipients receiving an electronic message from the subset of electronic messages exceeds a frequency threshold.

11. The method of claim 10 further comprises blocking the subset of electronic messages from reaching intended recipients.

12. The method of claim 10 further comprises placing the particular domain name on a list of spam domain names.

13. The method of claim 10 wherein determining if the particular domain name was registered with a domain name registrar further comprises archiving zone files for each top level domain on a daily basis and determining if the particular domain name resides in a zone file which corresponds to the period of time.

14. The method of claim 10 further comprises determining how many different groups of associated recipients received an electronic message form the subset of electronic messages, where the plurality of recipients are grouped into groups of associated recipients, and deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name is not reputable and the number of different groups receiving an electronic message from the subset of electronic messages exceeds a frequency threshold.

15. A method for identifying unwanted email messages, comprising:

(a) identifying a domain name associated with an unwanted email message;

(b) determining a domain name server associated with the domain name;

(c) determining a network address for the domain name server;

(d) identifying each domain name server associated with the network address;

(e) identifying domain names associated with each of the domain name servers; and

(f) deeming any email message advertising an identified domain name as an unwanted email message.

16. The method of claim 15 further comprises repeating steps (b) thru (f) for each newly identified domain name.

17. The method of claim 15 further comprises blocking email messages advertising an identified domain name from reaching intended recipients.

18. The method of claim 15 further comprises blocking email messages advertising domain names associated with any of the identified domain name servers

19. The method of claim 15 further comprises placing the identified domain names on a list of spam domain names.

20. The method of claim 15 wherein identifying a domain name associated with an unwanted email message further comprises:

monitoring electronic messages being sent to a plurality of recipients;

identifying a subset of the electronic messages advertising a particular domain name;

determining if the particular domain name was registered with a domain name registrar within a period of time;

determining how many recipients received an electronic message from the subset of electronic messages; and

deeming the subset of electronic messages to be unsolicited bulk messages when the particular domain name advertised in the subset of electronic messages has been registered within the defined period of time and the number of recipients receiving an electronic message from the subset of electronic messages exceeds a frequency threshold.

21. The method of claim 15 wherein determining a domain name server associated with the domain name and determining a network address for the domain name server further comprises accessing root zone files for each top level domain.