Patent ID: 8204945

Claim:
A method for detecting potentially unwanted e-mail messages, comprising: receiving a plurality of e-mail messages; processing the plurality of e-mail messages by removing HTML comments and HTML tags from the plurality of e-mail messages; generating one or more hash values based on one or more portions of the plurality of e-mail messages such that each of the plurality of e-mail messages has one or more corresponding generated hash values; counting the one or more of the generated hash values associated with at least one of the plurality of e-mail messages that match one or more hash values associated with at least one prior e-mail message; determining that the at least one of the plurality of e-mail messages is a potentially unwanted e-mail message based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more of the hash values associated with the at least one prior e-mail message; generating at least one suspicion score for the at least one of the plurality of e-mail messages based on the counting of the one or more of the generated hash values associated with the at least one of the plurality of e-mail messages that match the one or more hash values associated with the at least one prior e-mail message; and taking remedial action on the at least one of the plurality of e-mail messages that is determined to be the potentially unwanted e-mail message, based on the at least one suspicion score, the taking remedial action including deleting a newly received e-mail message.