Abstract: According to a first embodiment of the invention, if an e-mail sender attempts to make too many connections within a predetermined period of time, the excess connections are automatically rejected. According to a second embodiment of the invention, an agreement is established between an e-mail sender and an e-mail recipient that states when the sender may send e-mail messages to the recipient. According to a third embodiment of the invention, trend data reflecting an amount of e-mail sent by a sender is collected. The trend data can be used to establish a rate limit for the sender. According to a fourth embodiment of the invention, separate rate limits are established for authenticated and unauthenticated mail from addresses. According to a fifth embodiment of the invention, a sender may have a rate at which their e-mail is transmitted reduced if they exceed predetermined rate limits.

Abstract: According to a first embodiment of the invention, if an e-mail sender attempts to make too many connections within a predetermined period of time, the excess connections are automatically rejected. According to a second embodiment of the invention, an agreement is established between an e-mail sender and an e-mail recipient that states when the sender may send e-mail messages to the recipient. According to a third embodiment of the invention, trend data reflecting an amount of e-mail sent by a sender is collected. The trend data can be used to establish a rate limit for the sender. According to a fourth embodiment of the invention, separate rate limits are established for authenticated and unauthenticated mail from addresses. According to a fifth embodiment of the invention, a sender may have a rate at which their e-mail is transmitted reduced if they exceed predetermined rate limits.

Abstract: According to a first embodiment of the invention, if an e-mail sender attempts to make too many connections within a predetermined period of time, the excess connections are automatically rejected. According to a second embodiment of the invention, an agreement is established between an e-mail sender and an e-mail recipient that states when the sender may send e-mail messages to the recipient. According to a third embodiment of the invention, trend data reflecting an amount of e-mail sent by a sender is collected. The trend data can be used to establish a rate limit for the sender. According to a fourth embodiment of the invention, separate rate limits are established for authenticated and unauthenticated mail from addresses. According to a fifth embodiment of the invention, a sender may have a rate at which their e-mail is transmitted reduced if they exceed predetermined rate limits.

Abstract: According to a first embodiment of the invention, if an e-mail sender attempts to make too many connections within a predetermined period of time, the excess connections are automatically rejected. According to a second embodiment of the invention, an agreement is established between an e-mail sender and an e-mail recipient that states when the sender may send e-mail messages to the recipient. According to a third embodiment of the invention, trend data reflecting an amount of e-mail sent by a sender is collected. The trend data can be used to establish a rate limit for the sender. According to a fourth embodiment of the invention, separate rate limits are established for authenticated and unauthenticated mail from addresses. According to a fifth embodiment of the invention, a sender may have a rate at which their e-mail is transmitted reduced if they exceed predetermined rate limits.

Abstract: A classifier is implemented to determine the number of message transfer agents (MTAs) through which an email message has traveled. If the number of MTAs through which the email message has traveled is below a predetermined threshold and the email message is not otherwise authenticated, the classifier will designate the email message as abusive.

Abstract: A classifier is implemented to determine the number of message transfer agents (MTAs) through which an email message has traveled. If the number of MTAs through which the email message has traveled is below a predetermined threshold and the email message is not otherwise authenticated, the classifier will designate the email message as abusive.

Abstract: A classifier is implemented to determine the number of message transfer agents (MTAs) through which an email message has traveled. If the number of MTAs through which the email message has traveled is below a predetermined threshold and the email message is not otherwise authenticated, the classifier will designate the email message as abusive.

Abstract: A classifier is implemented to determine the number of message transfer agents (MTAs) through which an email message has traveled. If the number of MTAs through which the email message has traveled is below a predetermined threshold and the email message is not otherwise authenticated, the classifier will designate the email message as abusive.

Abstract: A classifier is implemented to determine the number of message transfer agents (MTAs) through which an email message has traveled. If the number of MTAs through which the email message has traveled is below a predetermined threshold and the email message is not otherwise authenticated, the classifier will designate the email message as abusive.

Abstract: A method and system for detecting spoofed network connections comprising receiving a connection from a client, delaying sending a greeting message for a delay period, monitoring the connection during the delay period, and if a command is received from the client before the greeting is sent, then identifying the connection as a possible spoofed connection.