Abstract: Described is a technology by existing IP address blacklist data associated are accessed to statistically determine which IP addresses in the range are spam-related IP addresses. If enough are identified, the rest of the range's IP addresses are considered as likely being spam-related addresses. The entire range may be then added to a range weighted blacklist used to detect spam. Before adding the range to the range weighted blacklist, the addresses may be further processed against known good traffic data and/or safe list data to determine whether an exception exists that indicates a good sender. If there is an exception, the range is not added to the range weighted blacklist; the range may be shrunk and re-processed until added to the weighted blacklist or until the size is too small.

Abstract: The subject disclosure is directed towards reducing the amount of resources needed to scan email messages for spam. In general, the previous email relationship between a sender and recipient, if any, may be considered in determining how aggressive the filtering level is set for scanning a message for spam, e.g., which filters will be used in the scan. For existing relationships where there has been no previously detected spam (there is good reputation data associated with the relationship), a less aggressive filtering level may be used, thereby saving resources. A relationship may be directly between the sender and recipient, or may be indirect, e.g., via a common third party. Also described is differentiating email from bulk senders from other email messages, for different handling, including spam filtering.

Abstract: Described is a technology by existing IP address blacklist data associated are accessed to statistically determine which IP addresses in the range are spam-related IP addresses. If enough are identified, the rest of the range's IP addresses are considered as likely being spam-related addresses. The entire range may be then added to a range weighted blacklist used to detect spam. Before adding the range to the range weighted blacklist, the addresses may be further processed against known good traffic data and/or safe list data to determine whether an exception exists that indicates a good sender. If there is an exception, the range is not added to the range weighted blacklist; the range may be shrunk and re-processed until added to the weighted blacklist or until the size is too small.