Abstract: The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA—0 and a receiving message transfer agent MTA—1; catches MTA—0's IP address IP—0, MTA—0's declared domain D—0, from-address A—0; and to-address A—1; and uses this source and content based information to test for unsolicited messages. It interrupts the conversation when MTA—0 sends a command_specifying the recipient (an “RCPT” command) and uses the various test results to decide if the message is suspected of being unsolicited. If the message is suspected of being unsolicited then it logs the rejected message, sends an error reply to MTA—0 which forces MTA—0 to terminate the connection with MTA—1 before the body of the message is transmitted; else it logs the allowed message, releases the intercepted RCPT command which allows the conversation between MTA—0 and MTA—1 to proceed.

Abstract: The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA—0 and a receiving message transfer agent MTA—1; catches MTA—0's IP address IP—0, MTA—0's declared domain D—0, from-address A—0; to-address A—1, and the body of the message; and uses this source and content information to test for unsolicited messages. It alters the conversation to reject, divert or intercept the message if the message is suspected of being unsolicited.

Abstract: The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA—0 and a receiving message transfer agent MTA—1; catches MTA—0's IP address IP—0, MTA—0's declared domain D—0, from-address A—0; and to-address A—1; and uses this source and content based information to test for unsolicited messages. It interrupts the conversation when MTA—0 sends a RCPT command and uses the various test results to decide if the message is suspected of being unsolicited. If the message is suspected of being unsolicited and to-address is not in the save_spam database then the spam blocker logs the rejected message, sends an error reply to MTA—0 which forces MTA—0 to terminate the connection before the body of the message is transmitted.

Abstract: The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA—0 and a receiving message transfer agent MTA—1; catches MTA—0's IP address IP—0, MTA—0's declared domain D—0, from-address A—0; to-address A—1, and the body of the message; and uses this source and content information to test for unsolicited messages. It interrupts the conversation when MTA—0 sends a .\r\n end-of-message indicator and uses the various test results to decide if the message is suspected of being unsolicited. If the message is suspected of being unsolicited then it logs the rejected message and sends an error reply to MTA—0 which forces MTA—0 to send a QUIT command before the body of the message is transmitted; else it logs the allowed message and releases the intercepted RCPT command which allows the conversation between MTA—0 and MTA—1 to proceed.

Abstract: The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA—0 and a receiving message transfer agent MTA—1; catches MTA—0's IP address IP—0, MTA—0's declared domain D—0, sender_address A—0; and recipient A—1; and uses this source and content based information to test for unsolicited messages. It interrupts the conversation when MTA—0 sends a command specifying the recipient (an “RCPT” command) and uses the various test results to decide if the message is suspected of being unsolicited. If the message is suspected of being unsolicited then it logs the rejected message, sends an error reply to MTA—0 which forces MTA—0 to terminate the connection with MTA—1 before the body of the message is transmitted; else it logs the allowed message, releases the intercepted RCPT command which allows the conversation between MTA—0 and MTA—1 to proceed.

Abstract: A set of unsolicited e-mail messages is collected and “finger printed” by either sampling the unsolicited message and using portions of the samples to form the identifier or by hashing a portion of the message. These “finger prints” are used to construct an unsolicited message database. The client's e-mail messages are processed in off-line manner by periodically fetching their messages; “finger printing” each message in a manner identical to the unsolicited messages; checking to see if the “finger print” is in the unsolicited message database; discarding any messages with a “finger print” in the unsolicited message database; and forwarding any message with a “finger print” not in the unsolicited message database to the “clean” POP server.