Method of determining network addresses of senders of electronic mail messages

A computer-readable tangible storage medium storing one or more sequences of instructions which, when executed by one or more processors, cause the one or more processors to perform:

• receiving a plurality of electronic mail messages containing sender address information that is non-trusted;
• for each particular one of the electronic mail messages:
• storing information about the particular message in a database record;
• creating and storing one or more receiving node identifiers in association with respective connected node identifiers,
• wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;
• based on the associations between the receiving node identifiers and the respective connected node identifiers, selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith;
• selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;
• storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

An apparatus, comprising:

• means for receiving a plurality of electronic mail messages containing sender address information that is non-trusted;
• means for storing information about each particular one of the electronic mail messages in a database record;
• means for creating and storing one or more receiving node identifiers in association with respective connected node identifiers,
• wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;
• means for selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith, based on the associations between the receiving node identifiers and the respective connected node identifiers;
• means for selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;
• means for storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.

An apparatus, comprising:

• one or more processors coupled to a network interface;
• a computer-readable tangible storage medium coupled to the one or more processors and carrying one or more sequences of instructions which, when executed by the processors, cause the one or more processors to perform:
• receiving a plurality of electronic mail messages containing sender address information that is non-trusted;
• for each particular one of the electronic mail messages:
• storing information about the particular message in a database record;
• creating and storing one or more receiving node identifiers in association with respective connected node identifiers,
• wherein the receiving node identifier identifies a receiving mail server that received the particular message and the connected node identifier identifies a connected mail server that directly connected to the receiving mail server to send the particular message directly to the receiving mail server;
• based on the associations between the receiving node identifiers and the respective connected node identifiers, selecting one particular receiving node identifier that has a largest number of directly connected node identifiers associated therewith;
• selecting one particular connected node identifier that is associated with the one particular receiving node identifier that has the largest number of the associated connected node identifiers;
• storing, in the database record, in a sender field that identifies a sender of the particular message, the one particular connected node identifier.