Patent ID: 7899870

Claim:
A computer-implemented method for detecting spam sources not currently listed on a blocked list, the method comprising: selecting a malicious message indicative of spam from a known spam source on the blocked list; selecting a portion of content of the malicious message likely to be contained in other spam messages; generating a first identifier from the portion of content for identifying spam associated with the known spam source; analyzing a content of a first message transmitted by the known spam source to a first recipient, for detecting in the first message, a second identifier that is consistent with the first identifier; if the second identifier is found in the first message: querying a database containing information of one or more recipients that re-transmitted the first message at least once; obtaining the identity of the first recipient from the database, if the first recipient is one amongst the one or more recipients that re-transmitted the first message at least once; analyzing message traffic patterns associated with the first recipient, for detecting a suspicious behavior; and if the suspicious behavior is detected, declaring the first recipient an additional source of spam.