Patent ID: 8381291

Claim:
A method of detecting and responding to an email address harvest attack at an Internet service provider email system, comprising: counting a number of failed email address look-ups during a single simple mail transfer protocol session associated with an originating Internet protocol address; responding to the originating Internet protocol address with a positive acknowledgement that an otherwise invalid email address exists when the count of the number of failed email address look-ups exceeds a threshold; creating a fake email inbox for each otherwise invalid email address responded to with the positive acknowledgement, each fake email inbox having a spam folder associated therewith; and processing email addressed to each fake email inbox using a spam filter; wherein responding to the originating Internet protocol address with the positive acknowledgement comprises: responding to the originating Internet protocol address with the positive acknowledgement that the otherwise invalid email address exists at a response percentage rate for subsequent failed email address look-ups responsive to the number of failed email address lookups exceeding the threshold.