Patent ID: 8601064

Claim:
A method to be performed by an email gateway or a server computer in a private computer network, the method comprising: obtaining a list of internet protocol (IP) addresses of known legitimate email sources; determining a recipient failed count comprising a total number of invalid recipient email addresses from emails from an email source within a predetermined period of time; determining a total message count comprising a total number of emails received from the email source within the predetermined period of time; determining a first ratio of the recipient failed count over the total message count; determining a message failed count comprising a number of emails from the email source having at least one invalid recipient address; determining a bounce ratio comprising the message failed count over the total message count if the IP address of the email source is in the list of IP addresses of known legitimate email sources; and classifying the IP address of the email source as a malicious source for a limited period of time if the recipient failed count exceeds a first threshold value, the total message count exceeds a second threshold value, the first ratio exceeds a third threshold value, and the bounce ratio exceeds a fourth threshold value.