Using IP address and domain for email spam filtering

A method implemented by at least one processor, the method comprising:

• receiving an email message;
• determining an IP address associated with a sender of the email message;
• determining a domain from which the email message appears to have been sent;
• generating an IP address set comprising combination of multiple portions of the IP address;
• generating a domain address set comprising combination of one or more portions of the domain name;
• generating, by the at least one processor, an IP/domain set by computing a cross-product of the IP address set and the domain set, each element of the IP/domain set representing a unique pair of a portion of the IP address and portion of the domain name;
• for each element of the IP/domain set, identifying a previously determined element spam score that represents a likelihood that an email message received from an IP address and domain that matches the element is spam;
• determining a message spam score by combining the previously determined element spam scores;
• and
• determining whether to treat the email message as spam based on the message spam score.

A system, comprising:

• a processor;
• a memory;
• a sender IP determination module stored in the memory and executed by the processor, the sender IP determination module configured to determine an IP address from which a received email message was sent;
• a sender domain determination module configured to determine a domain from which the received email message appears to have been sent;
• an IP X domain generation module configured to:
• expand the IP address into a set of partial IP addresses;
• expand the domain into a set of domain portions;
• and
• generate a cross product, (IP X Domain), of the set of partial IP addresses and the set of domain portions;
• a machine learning algorithm configured to calculate a spam score to be associated with an element of (IP X Domain);
• and
• a data repository configured to maintain an association between the element of (IP X Domain) and the spam score.