Patent ID: 8001598

Claim:
A computer implemented method for detecting suspected spam in e-mail originating from a sending computer, said method comprising: using a computer to perform steps comprising: determining an actual Internet Protocol (IP) address of the sending computer; converting the actual IP address into geo-location data comprising information about a geographical location associated with the sending computer; and using the geo-location data, ascertaining whether the e-mail contains suspected spam, wherein the ascertaining comprises: comparing the geo-location data with a claimed geo-location claimed by the sending computer, wherein the claimed geo-location is derived from a Domain Name System (DNS) address claimed by the sending computer and is a location where a domain within the DNS address has a mail transfer agent, locations where the domain has a mail transfer agent are listed in a database, and the database is compiled with respect to e-mail allegedly emanating from common domains; and determining whether the e-mail contains suspected spam responsive to the comparison of the geo-location data with the claimed geo-location.