Patent ID: 7836133

Claim:
A method, comprising: before receiving any electronic message: retrieving a whitelist comprising a plurality of first network resource identifiers that are known not to be associated with threats; retrieving a particular first network resource identifier from the whitelist; generating a first list of properties for the particular first network resource identifier; training, using the properties of the first list, a probabilistic filter to recognize future electronic mail messages that are not associated with threats; repeating the retrieving and training for all the first network resource identifiers in the whitelist; retrieving a blocklist comprising a plurality of second network resource identifiers that are known to be associated with threats; retrieving a particular second network resource identifier from the blocklist; generating a second list of properties for the particular second network resource identifier; training, using the properties of the second list, the probabilistic filter to recognize future electronic mail messages that are associated with threats; repeating the retrieving and training for all the second network resource identifiers in the blocklist; wherein the network resource identifiers are uniform resource locators (URLs); wherein generating properties comprises obtaining information from “whois” queries, based on a domain name owner for a domain name contained in the particular first network resource identifier or the particular second network resource identifier.