Method and system for categorizing and processing e-mails

• US 7,206,814 B2
• Filed: 10/09/2003
• Issued: 04/17/2007
• Est. Priority Date: 10/09/2003
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Propel Software Corporation (GlobalPOPs, Inc.)
• Inventors: Kirsch, Steven T.
• Primary Examiner(s): Meky; Moustafa M.
• Application Number:
  US10/683,598
• Publication Number:
  US 20050080856A1
• Time in Patent Office: 1,286 Days
• Field of Search: 709200-207, 709217-227
• US Class Current: 709/206
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An e-mail filtering method and system that categorize received e-mail messages based on information about the sender. Data about the sender is contained in the message and is used to identify the actual sender of the message using a signature combining pieces of information from the message header or derived from information in the message header. This and other information about the message is then sent by each member of an e-mail network to one or more central databases (in one embodiment, the information will also be stored at a database associated with the recipient'"'"'s e-mail program and filtering software) which stores the information and compiles statistics about e-mails sent by the sender to indicate the likelihood that the e-mail is unsolicited and determine the reputation of the sender (a good reputation indicates the sender does not send unwanted messages while a bad reputation indicates the sender sends unsolicited e-mail messages). Information from the central database is then sent to recipients in order to determine the likelihood that a received e-mail message is spam (information may also be obtained from the local database associated with the recipient'"'"'s e-mail program and filtering software).

Claims

1. In a network, a method of processing e-mail messages comprising:

a) receiving an e-mail message from an unknown sender;

b) requesting information about the sender from at least one database that compiles global statistics about senders based on information about the sender received from recipients in the network, wherein compiling statistics includes determining a ratio reflecting whether the sender sends a majority of messages to recipients who have included the sender on a whitelist, wherein the statistics are used to determine a sender'"'"'s reputation, wherein the sender is identified based on data in the message header including at least one of the following;

i) an actual sender;

ii) a final IP address used by the sender;

iii) a final domain name used by the sender;

or

iv) an IP path used by the sender; and

c) categorizing whether the e-mail message is good based on information received about the sender'"'"'s reputation, wherein the e-mail message is allowed through a recipient'"'"'s e-mail filter it the reputation as good and the e-mail message is not allowed through the e-mail filter if the reputation is either not good or not known.

2. The method of claim 1 wherein the actual sender is identified by a signature that includes at least two of the following fields from the message header;

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) a final IP address used by the sender;

e) a final domain name used by the sender;

f) a user-agent;

g) a timezone;

h) a source IP address;

i) a name of client software used by the sender;

j) a sendmail version used by a first receiver; and

k) an IP path used to route the message.

3. The method of claim 1 wherein the actual sender is identified by a signature including a range of IP addresses and at least one of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) the final IP address used by the sender;

e) the final domain name used by the sender;

f) the name of client software used by the actual sender;

g) user-agent;

h) timezone;

i) source IP address;

j) sendmail version used by a first receiver; and

k) the IP path used to route the message.

4. The method of claim 1 wherein the at least one database includes one of the following:

a) a central database;

or

b) at least two centrally-maintained databases, each storing and compiling different information and statistics.

5. The method of claim 1 further comprising using statistics compiled at the at least one database to compute a score indicating a likelihood that the received message is an unsolicited message.

6. The method of claim 5 wherein the score increases as a number of accepted messages having the same information about the sender as the received message increases, the information including one of the following:

a) the actual sender;

b) a final IP address;

c) a final domain name;

or

d) an IP path.

7. The method of claim 5 wherein the score decreases as a number of rejected messages having the same information about the sender as the received message increases, the information including one of the following:

a) the actual sender;

b) a final IP address;

c) a final domain name;

or

d) an IP path.

8. The method of claim 1 further comprising tracking at least one of the following pieces of information about messages from senders:

a) a total number of messages sent;

b) a total number of messages sent over a first predetermined time period;

c) a total number of messages sent to recipients in the network who have included the sender on a whitelist;

d) a number of messages sent to recipients in the network who have included the sender on the whitelist over a second predetermined time period;

e) a number of recipients who have included the sender on the recipient'"'"'s whitelist;

f) a total number of times a recipient changed a sender'"'"'s whitelist/blacklist status;

g) a number of times a recipient changed a sender'"'"'.s whitelist/blacklist status over a third predetermined time period;

h) a total number of messages sent to recipients in the network who have not included the sender on the whitelist;

i) a number of messages sent to recipients in the network who have not included the sender on the whitelist over a fourth predetermined time period;

j) a total number of unique recipients in the network who have received at least one message from the sender;

k) a total number of messages sent to unique recipients in the network who have included the sender on the whitelist; and

l) a total number of messages sent to unique recipients in the network who have not included the sender on the whitelist,

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

9. The method of claim 1 wherein compiling statistics about senders includes at least one of the following:

a) determining a ratio of a first number e-mail messages sent by a sender to recipients in the network who have included the sender on a whitelist in a predetermined time period divided by a second number of e-mail messages sent by the sender to users in the network in the predetermined time period;

b) determining a ratio of a first number of recipients in the network who have included the sender on the whitelist divided by a second number of unique recipients in the network who received e-mails from the sender in a predetermined time period;

c) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a whitelist to a blacklist divided by a second number of times a message from the sender was moved from a whitelist to a blacklist;

d) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a blacklist to a whitelist divided by a second number of times a message from the sender was moved from a blacklist to a whitelist;

e) determining a ratio of a first number of unique users within the network who whitelisted the sender within a predetermined time period compared to a second number of unique users within the network who blacklisted the sender within the predetermined time period;

f) determining a ratio reflecting a first number of wanted messages sent by the sender compared to a second number of unwanted or total messages sent by the sender;

g) determining a difference between a first number of expected messages sent by the sender and a second number of unexpected messages sent by the sender;

h) determining a difference between a first number of times a user whitelisted a message from the sender and a second number of times a user blacklisted a message from the sender; and

i) determining a difference reflecting whether the sender sends a majority of messages to known recipients,

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

10. The method of claim 1 further comprising placing a message which is not allowed through the e-mail filter in a span folder.

11. The method of claim 10 further comprising monitoring the span folder at predetermined intervals to determine whether messages in the folder should be released because the reputation of the sender has changed.

12. The method of claim 1 further comprising monitoring the inbox at predetermined intervals to determine whether messages should remain in the inbox.

13. The method of claim 1 further comprising maintaining at the database at least four of the following values:

a) a number of messages which were explicitly ranked good;

b) a number of messages which were implicitly ranked good;

c) a number of messages whose ranking is unknown;

d) a number of messages which were explicitly ranked bad; and

e) a number of messages which were implicitly ranked bad;

wherein the values are based on messages having the same information about the sender including one of the following;

a) the signature;

b) a final IP address used by the sender;

c) a final domain name used by the sender;

or

d) an IP path used by the sender.

14. The method of claim 13 wherein the values represent one of the following:

a) message counts;

or

b) ratings of unique sets within the network.

15. The method of claim 14 further comprising at least four of the values being returned to the recipient to allow the recipient to apply different weights to a message in order to categorize the message.

16. The method of claim 1 further comprising tracking local statistics about senders identified by data in the message header at a local database.

17. The method of claim 1 further comprising assessing the reputation of the sender of a received message when user activity is observed.

18. The method of claim 1 further comprising sending recipients a notification when any sender'"'"'s reputation changes.

19. The method of claim 18 further comprising reviewing all messages received in a predetermined time period preceding receipt of the notification and updating the categorization of the message as necessary.

20. In a network, a method of processing e-mail messages comprising:

a) receiving information about e-mail messages from recipients of the messages in the network, wherein the information received includes;

i) an identification of a sender of a first message, wherein the identification is based on data in the message header and includes at least one of the following;

A) an actual sender;

B) a final IP address used by the sender;

C) a final domain name used by the sender;

or

D) an IP path used by the sender; and

ii) an indication of whether the recipient considered the first message good or bad;

b) compiling global statistics for senders of messages wherein the statistics are used to determine a sender'"'"'s reputation for sending good messages, the statistics including a total number of messages sent to unique recipients in the network who have included the sender on a whitelist; and

c) creating a list of senders with good reputations that may be referenced by recipients of messages from unknown senders in the network, wherein a second message from one sender on the list is allowed through a recipient'"'"'s e-mail filter and a third message from another sender not on the list is not allowed through the recipient'"'"'s e-mail filter.

21. The method of claim 20 wherein the actual sender is identified by a signature having at least two of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) a final IP address used by the sender;

e) a final domain name used by the sender;

f) a user-agent;

g) a timezone;

h) a source IP address;

i) a name of client software used by the sender;

j) a sendmail version used by a first receiver; and

k) an IP path used to route the message.

23. The method of claim 20 wherein the at least one database includes one of the following:

a) a central database;

or

b) at least two centrally-maintained databases, each storing and compiling different information and statistics.

24. The method of claim 20 further comprising using statistics compiled at the at least one database to determine a sender'"'"'s reputation.

25. The method of claim 24 further comprising adding a sender to the list when the sender'"'"'s reputation passes a predetermined threshold indicating a good reputation.

26. The method of claim 24 further comprising removing a sender from the list when the sender'"'"'s reputation is below a predetermined threshold indicating a good reputation.

27. The method of claim 20 further comprising tracking at least one of the following pieces of information about messages from senders:

a) a total number of messages sent;

b) a total number of messages sent over a first predetermined time period;

c) a total number of messages sent to recipients in the network who have included the sender on a whitelist;

d) a number of messages sent to recipients in the network who have included the sender on the whitelist over a second predetermined time period;

e) a number of recipients who have included the sender on the recipient'"'"'s whitelist;

f) a total number of times a recipient changed a sender'"'"'s whitelist/blacklist status;

g) a number of times a recipient changed a sender'"'"'s whitelist/blacklist status over a third predetermined time period;

h) a total number of messages sent to recipients in the network who have not included the sender on the whitelist;

i) a number of messages sent to recipients in the network who have not included the sender on the whitelist over a fourth predetermined time period;

j) a total number of unique recipients in the network who have received at least one message from the sender; and

k) a total number of messages sent to unique recipients in the network who have not included the sender on the whitelist,

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

28. The method of claim 20 wherein compiling statistics about senders includes at least one of the following:

a) determining a ratio of a first number e-mail messages sent by a sender to recipients in the network who have included the sender on a whitelist in a predetermined Lime period divided by a second number of e-mail messages sent by the sender to users in the network in the predetermined time period;

b) determining a ratio of a first number of recipients in the network who have included the sender on the whitelist divided by a second number of unique recipients in the network who received e-mails from the sender in a predetermined time period;

c) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a whitelist to a blacklist divided by a second number of times a message from the sender was moved from a whitelist to a blacklist;

d) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a blacklist to a whitelist divided by a second number of times a message from the sender was moved from a blacklist to a whitelist;

e) determining a ratio of a first number of unique users within the network who whitelisted the sender within a predetermined time period compared to a second number of unique users within the network who blacklisted the sender within the predetermined time period;

f) determining a ratio reflecting whether the sender sends a majority of messages to recipients who have included the sender on the whitelist;

g) determining a ratio reflecting a first number of wanted messages sent by the sender compared to a second number of unwanted or total messages sent by the sender;

h) determining a difference between a first number of expected messages sent by the sender and a second number of unexpected messages sent by the sender;

i) determining a difference between a first number of times a user whitelisted a message from the sender and a second number of times a user blacklisted a message from the sender; and

j) determining a difference reflecting whether the sender sends a majority of messages to known recipients,

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain names or the IP path used to send the message.

29. The method of claim 20 further comprising placing a message which is not allowed through the e-mail filter in a spam folder.

30. The method of claim 29 further comprising monitoring the span folder at predetermined intervals to determine whether messages in the folder should be released because the reputation of the sender has changed.

31. The method of claim 20 further comprising monitoring the inbox at predetermined intervals to determine whether messages should remain in the inbox.

32. The method of claim 20 further comprising maintaining at the database at least four of the following values:

a) a number of messages which were explicitly ranked good;

b) a number of messages which were implicitly ranked good;

c) a number of messages whose ranking is unknown;

d) a number of messages which were explicitly ranked bad; and

e) a number of messages which were implicitly ranked bad;

wherein the values are based on messages having the same information about the sender including one of the following;

a) the signature;

b) a final IP address used by the sender;

c) a final domain name used by the sender;

or

d) an IP path used by the sender.

33. The method of claim 32 wherein the values represent one of the following:

a) message counts;

or

b) ratings of unique users within the network.

34. The method of claim 20 further comprising tracking local statistics about senders identified by data in the message header at a local database.

35. The method of claim 20 further comprising assessing the reputation of the sender of a received message when user activity is observed.

36. The method of claim 20 further comprising sending recipients a notification when any sender'"'"'s reputation changes.

37. The method of claim 20 further comprising reviewing all messages received in a predetermined time period preceding receipt of the notification and updating the categorization of the message as necessary.

49. The system of claim 32 further comprising the first software means placing a message which is not allowed through the e-mail filter in a spam folder.

50. The system of claim 49 further comprising the second software means monitoring the spain folder at predetermined intervals to determine whether messages in the folder should be released because the reputation of the sender has changed.

51. The system of claim 50 further comprising the second software means monitoring the inbox at predetermined intervals to determine whether messages should remain in the inbox.

22. The method of clam 21 wherein the actual sender is identified by a signature including a range of IP addresses and at least one of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) the final IP address used by the sender;

e) the final domain name used by the sender;

f) the name of client software used by the actual sender;

g) user-agent;

h) timezone;

i) source IP address;

j) sendmail version used by a first receiver; and

k) the IP path used to route the message.

38. In a network, a system for processing e-mail messages comprising:

at least one database in network communication with a plurality of recipients of e-mail messages, each of the recipients having a first software means for filtering received e-mail messages, the database having second software means for performing the following;

i) receiving information about e-mail messages from the recipients of the messages, wherein the information received includes;

A) an identification of a sender of a first message based on data in the message header including at least one of the following;

I) an actual sender;

II) a final IP address used by the sender;

III) a final domain name used by the sender;

IV) an IP path used by the sender; and

B) an indication of whether the recipient classified the first message as good or bad;

ii) compiling statistics for sender of messages, wherein compiling statistics includes determining a ratio reflecting whether the sender sends a majority of messages to recipients who have included the sender on a whitelist, wherein the statistics are used to determine a sender'"'"'s reputation for sending good messages; and

iii) sending statistics in response to a request for statistics from the recipient of a message from an unknown sender, wherein if the sender has a good reputation the message is allowed through the first software means and if the sender has a not good or not known reputation the message is not allowed through the first software means.

39. The system of claim 38 wherein the at least one database includes one of the following:

a) a central database;

or

b) at least two centrally-maintained databases, each storing and compiling different information and statistics.

40. The system of claim 38 wherein the at least one database and the plurality of recipients are members of an e-mail network.

41. The system of claim 38 further comprising an incoming mail server in network connection with each of the plurality of recipients.

42. The system of claim 38 wherein the actual sender is identified by signature including at least two of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) a final IP address used by the sender;

e) a final domain name used by the sender;

f) a user-agent;

g) a timezone;

h) a source IP address;

i) a name of client software used by the sender

j) a sendmail version used by a first receiver; and

k) an IP path used to route the message.

43. The system of claim 38 wherein the actual sender is identified by a signature including a range of IP addresses and at least one of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) the final IP address used by the sender;

e) the final domain name used by the sender;

f) the name of client software used by the actual sender;

g) user-agent;

h) timezone;

i) source IP address;

j) sendmail version used by a first receiver; and

k) the IP path used to route the message.

44. The system of claim 38 further comprising either the first or second software means using statistics compiled at the at least one database to compute a score indicating a likelihood that the received message is an unsolicited message.

45. The system of claim 44 wherein the score increases as a number of accepted messages having the same information about the sender as the received message increases, the information including one of the following:

a) the actual sender;

b) a final IP address;

c) a final domain name;

or

d) an IP path.

46. The system of claim 44 wherein the score decreases as a number of rejected messages having the same information about the sender as the received message increases, the information including one of the following:

a) the actual sender;

b) a final IP address;

c) a final domain name;

or

d) an IP path.

47. The system of claim 38 further comprising the second software means tracking at least one of the following pieces of information about messages from senders:

a) a total number of messages sent;

b) a total number of messages sent over a first predetermined time period;

c) a total number of messages sent to recipients in the network who have included the sender on a whitelist;

d) a number of messages sent to recipients in the network who have included the sender on the whitelist over a second predetermined time period;

e) a number of recipients who have included the sender on the recipient'"'"'s whitelist;

f) a total number of times a recipient changed a sender'"'"'s whitelist/blacklist status;

g) a number of times a recipient changed a sender'"'"'s whitelist/blacklist status over a third predetermined time period;

h) a total number of messages sent to recipients in the network who have not included the sender on the whitelist;

i) a number of messages sent to recipients in the network who have not included the sender on the whitelist over a fourth predetermined time period;

j) a total number of unique recipients in the network who have received at least one message from the sender;

k) a total number of messages sent to unique recipients in the network who have included the sender on the whitelist; and

l) a total number of messages sent to unique recipients in the network who have not included the sender on the

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

48. The system of claim 38 wherein compiling statistics about senders includes at least one of the following:

a) determining a ratio of a first number e-mail messages sent by a sender to recipients in the network who have included the sender on a whitelist in a predetermined time period divided by a second number of e-mail messages sent by the sender to users in the network in the predetermined time period;

b) determining a ratio of a first number of recipients in the network who have included the sender on the whitelist divided by a second number of unique recipients in the network who received s-mails from the sender in a predetermined time period;

c) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a whitelist to a blacklist divided by a second number of times a message from the sender was moved from a whitelist to a blacklist;

d) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a blacklist to a whitelist divided by a second number of times a message from the sender was moved from a blacklist to a whitelist;

e) determining a ratio of a first number of unique users within the network who whitelisted the sender within a predetermined time period compared to a second number of unique users within the network who blacklisted the sender within the predetermined time period;

f) determining a ratio reflecting a first number of wanted messages sent by the sender compared to a second number of unwanted or total messages sent by the sender;

g) determining a difference between a first number of expected messages sent by the sender and a second number of unexpected messages sent by the sender;

h) determining a difference between a first number of times a user whitelisted a message from the sender and a second number of times a user blacklisted a message from the sender; and

i) determining a difference reflecting whether the sender sends a majority of messages to known recipients,

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

52. The system of claim 38 further comprising the second software means maintaining at the database at least four of the following values:

a) a number of messages which were explicitly ranked good;

b) a number of messages which were implicitly ranked good;

c) a number of messages whose ranking is unknown;

d) a number of messages which were explicitly ranked bad; and

e) a number of messages which were implicitly ranked bad;

wherein the values are based on messages having the same information about the sender including one of the following;

a) the actual sender;

b) a final IP address used by the sender;

c) a final domain name used by the sender;

or

d) an IP path used by the sender.

53. The system of claim 52 wherein the values represent one of the following:

a) message counts;

or

b) ratings of unique users within the network.

54. The system of claim 53 further comprising the second software means returning at least four of the values being to the recipient to allow the recipient to apply different weights to a message in order to categorize the message.

55. The system of claim 38 further comprising a third software means tracking local statistics about senders identified by data in the message header at a local database.

56. The system of claim 38 further comprising the second software means assessing the reputation of the sender of a received message when user activity is observed.

57. The system of claim 38 further comprising the second software means sending recipients a notification when any sender'"'"'s reputation changes.

58. The system of claim 57 further comprising the first software means reviewing all messages received in a predetermined time period preceding receipt of the notification and updating the categorization of the message as necessary.

59. In a network, a system for processing e-mail messages comprising:

a database in network communication with a plurality of recipients of e-mail messages, each of the recipients having a first software means for filtering received e-mail messages, the database having a second software means for performing the following;

i) receiving information about e-mail messages from the recipients of the messages, wherein the information received includes;

A) an identification of a sender of a first message based on data in the message header including at least one of the following;

I) an actual sender;

II) a final IP address used by the sender;

III) a final domain name used by the sender;

or

IV) an IP path used by the sender; and

B) an indication of whether the recipient classified the first message as good or bad;

ii) compiling statistics for senders of messages, the statistics including a total number of messages sent to unique recipients in the network who have included the sender on a whitelist, wherein the statistics are used to determine a sender'"'"'s reputation for sending good messages; and

iii) creating a list of senders with good reputations that may be referenced by recipients of messages from unknown senders in the network, wherein a second message from one sender on the list is allowed through the recipient'"'"'s first software means for filtering received messages and a third message from another sender not on the list is not allowed through the recipient'"'"'s first software means for filtering received messages.

60. The system of claim 59 wherein the at least one database includes one of the following:

a) a central database;

or

b) at least two centrally-maintained databases, each storing and compiling different information and statistics.

61. The system of claim 59 wherein the at least one database and the plurality of recipients are members of an e-mail network.

62. The system of claim 59 further comprising an incoming mail server in network connection with each of the plurality of recipients.

63. The system of claim 59 wherein the actual sender is identified by a signature having at least two of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) a final IP address used by the sender;

e) a final domain name used by the sender;

f) a user-agent;

g) a timezone;

h) a source IP address;

i) a name of client software used by the sender;

j) a sendmail version used by a first receiver; and

k) an IP path used to route the message.

64. The system of claim. 59 wherein the actual sender is identified by a signature including a range of IP addresses and at least one of the following fields from the message header:

a) an e-mail address used by the sender;

b) a display name used by the sender;

c) a domain name used by the sender;

d) the final IP address used by the sender;

e) the final domain name used by the sender;

f) the name of client software used by the actual sender;

g) user-agent;

h) timezone;

i) source IP address;

j) sendmail version used by a first receiver; and

k) the IP path used to route the message.

65. The system of claim 59 further comprising the second software means using statistics compiled at the at least one database to determine a sender'"'"'s reputation.

66. The system of claim 65 further comprising adding a sender to the list when the sender'"'"'s reputation passes a predetermined threshold indicating a good reputation.

67. The system of claim 65 further comprising removing a sender from the list when the sender'"'"'s reputation is below a predetermined threshold indicating a good reputation.

68. The system of claim 59 further comprising the second software means tracking at least one of the following pieces of information about messages from senders:

a) a total number of messages sent;

b) a total number of messages sent over a first predetermined time period;

c) a total number of messages sent to recipients in the network who have included the sender on a whitelist;

d) a number of messages sent to recipients in the network who have included the sender on the whitelist over a second predetermined time period;

e) a number of recipients who have included the sender on the recipient'"'"'s whitelist;

f) a total number of times a recipient changed a sender'"'"'s whitelist/blacklist status;

g) a number of times a recipient changed a sender'"'"'s whitelist/blacklist status over a third predetermined time period;

h) a total number of messages sent to recipients in the network who have not included the sender on the whitelist;

i) a number of messages sent to recipients in the network who have not included the sender on the whitelist over a fourth predetermined time period;

j) a total number of unique recipients in the network who have received at least one message from the sender; and

k) a total number of messages sent to unique recipients in the network who have not included the sender on the whitelist,

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

69. The system of claim 59 wherein compiling statistics about senders includes at least one of the following:

a) determining a ratio of a first number e-mail messages sent by a sender to recipients in the network who have included the sender on a whitelist in a predetermined time period divided by a second number of e-mail messages sent by the sender to users in the network in the predetermined time period;

b) determining a ratio of a first number of recipients in the network who have included the sender on the whitelist divided by a second number of unique recipients in the network who received e-mails from the sender in a predetermined time period;

c) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a whitelist to a blacklist divided by a second number of times a message from the sender was moved from a whitelist to a blacklist;

d) determining a ratio of a first number of times in a predetermined time interval a message from the sender was moved from a blacklist to a whitelist divided by a second number of times a message from the sender was moved from a blacklist to a whitelist;

e) determining a ratio of a first number of unique users within the network who whitelisted the sender within a predetermined time period compared to a second number of unique users within the network who blacklisted the sender within the predetermined time period;

f) determining a ratio reflecting whether the sender sends a majority of messages to recipients who have included the sender on the whitelist;

g) determining a ratio reflecting a first number of wanted messages sent by the sender compared to a second number of unwanted or total messages sent by the sender;

h) determining a difference between a first number of expected messages sent by the sender and a second number of unexpected messages sent by the sender;

i) determining a difference between a first number of times a user whitelisted a message from the sender and a second number of times a use-n blacklisted a message from the sender; and

j) determining a difference reflecting whether the sender sends a majority of messages to known recipients.

wherein the sender is identified by one of the group consisting of the actual sender, the final IP address, the final domain name, or the IP path used to send the message.

70. The system of claim 59 further composing the first software means placing a message which is not allowed through the e-mail filter in a spam folder.

71. The system of claim 70 further comprising the second software means monitoring the spam folder at predetermined intervals to determine whether messages in the folder should be released because the reputation of the sender has changed.

72. The system of claim 59 further comprising the second software means monitoring the inbox at predetermined intervals to determine whether messages should remain in the inbox.

73. The system of claim 59 further comprising the second software means maintaining at the database at least four of the following values;

a) a number of messages which were explicitly ranked good;

b) a number of messages which were implicitly ranked good;

c) a number of messages whose ranking is unknown;

d) a number of messages which were explicitly ranked bad; and

e) a number of messages which were implicitly ranked bad;

wherein the values are based on messages having the same information about the sender including one of the following;

a) the signature;

b) a final IP address used by the sender;

c) a final domain name used by the sender;

or

d) an IP path used by the sender.

74. The system of claim 73 wherein the values represent one of the following:

a) message counts;

or

b) ratings of unique users within the network.

75. The system of claim 59 further comprising a third software means tracking local statistics about senders identified by data in the message header at a local database.

76. The system of claim 59 further comprising the second software means assessing the reputation of the sender of a received message when user activity is observed.

77. The system of claim 59 further comprising the second software means sending recipients a notification when any sender'"'"'s reputation changes.

78. The system of claim 77 further comprising the first software means reviewing all messages received in a predetermined time period preceding receipt of the notification and updating the categorization of the message as necessary.