Patent ID: 9148432
Filing Date: 2015-09-29
Classification: H04L

Abstract:
1. In a computing environment, a computer-implemented method performed at least in part on at least one processor, comprising: accessing data associated with a candidate range of Internet Protocol (IP) addresses to determine which IP addresses in the candidate range likely correspond to spam senders before the IP addresses have sent spam, in which the data indicates which IP addresses in the candidate range of IP addresses are spam-related IP addresses that have been identified as corresponding to spam messages; determining a value corresponding to how much of the candidate range comprises the spam-related IP addresses; evaluating traffic data corresponding to messages not identified as spam to determine whether to add the candidate range of IP addresses to a range weighted blacklist; evaluating safe list data to determine whether to add the candidate range of IP addresses to the range weighted blacklist, wherein the safe list data contains information that indicates whether at least one IP address in the candidate range of IP addresses is identified in a safe list data store; determining a new value corresponding to how much of the candidate range comprises the spam-related IP addresses, wherein the new value is lower than the value, depending on results of evaluating the traffic data and the safe list data; adding the candidate range of IP addresses to the range weighted blacklist based at least in part on the new value; and using the range weighted blacklist to proactively block individual IP addresses in the candidate range before the individual IP addresses in the candidate range send spam, wherein the range weighted blacklist is used to determine whether an incoming message likely corresponds to a spam message.