Abstract: An improved system and method for detecting spam e-mail over a distributed network is disclosed. The distributed network includes multiple servers that receive and process e-mail messages for a multiple remotely located clients. The system includes multiple packet sniffers that are each located on a unique one of servers. The packet sniffers extract originating IP addresses associated with e-mail messages that are communicated to the clients over the network. The system further includes a central monitor that communicates with the packet sniffers and that monitors data regarding originating IP addresses. The monitor determines whether an originating IP address has exceeded a threshold value and may take corrective measures in response, such as generating an alert to a spam analyst or blocking messages originating from that IP address. By leveraging data from several different clients, the system can detect and stop spam messages for an IP address even if a spammer has not targeted a specific customer.

Abstract: The present invention provides an improved system and method for processing e-mail. The system may be implemented over a distributed network having several redundant mail servers. The system may include a message switch that receives all incoming e-mail messages and includes a policy filter, a content filter, a virus filter and a spam filter. The filters process the message in a sequential order and can be dynamically reconfigured to adapt to certain conditions. The message is stored in an area of the message switch and the filters communicate with each other by passing links to the message in order to reduce input/output. This communication method may be altered to suit the installation of the software, without altering each filter. Messages that do not pass the filters may be rejected or placed in a quarantine area. Messages that pass all of the filters are delivered to their intended recipients.

Abstract: The present invention provides an improved system and method for analyzing spam e-mail. The system and method monitors instances of spam across a distributed network, and creates and stores records of these instances as encoded information strings, which are attached to each message as a header. The system and method use information and statistics obtained from the information strings to dynamically create, modify and retire rules for analyzing and managing spam e-mail. The system also allows analysts to dynamically create, modify and retire rules based upon feedback regarding unidentified spam messages and false positives.

Abstract: The present invention provides an improved system and method for disaster recovery and management of an email system. The system includes a deferral monitor that detects when a failure occurs in a client's email system, and a mailbox creation process and automatically creates mailbox accounts for the affected domains that queue incoming mail while the failure is repaired. This ensures no email is bounced because of the unavailable mail servers. Once the email servers are reconnected, the system forwards queued email to the client in a “flow-controlled” manner until all email is delivered. The system may further include a web mail interface that allows the client to maintain email functionality until the failure is repaired. The system may also include a message switch that filters all email for policy and content rules, spam and viruses before passing the email to the client.

Abstract: The present invention provides an improved system and method for disaster recovery and management of an email system. The system includes a deferral monitor that detects when a failure occurs in a client's email system, and a mailbox creation process and automatically creates mailbox accounts for the affected domains that queue incoming mail while the failure is repaired. This ensures no email is bounced because of the unavailable mail servers. Once the email servers are reconnected, the system forwards queued email to the client in a “flow-controlled” manner until all email is delivered. The system may further include a web mail interface that allows the client to maintain email functionality until the failure is repaired. The system may also include a message switch that filters all email for policy and content rules, spam and viruses before passing the email to the client.