# US 8,788,596 B1 · Unsolicited message rejecting communications processor > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,596 B1 - Document ID: US8788596B1 - Status: Granted - Kind: B1 - Application number: 12/317,938 - Filed: 2008-12-30 - Granted: 2014-07-22 - Earliest claimed: 2002-09-09 - Assignees: Engate Technology Corporation - Applicants: Richard Paul White; Alan Huang; Haw-minn Lu; Ira Victor Spivack - Inventors: Richard Paul White; Alan Huang; Haw-minn Lu; Ira Victor Spivack - Web page: https://patentgrep.com/patent/US8788596B1 ## CPC - H04L 51/212: using filtering or selective blocking - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The spam blocker monitors the SMTP/TCP/IP conversation between a sending message transfer agent MTA—0 and a receiving message transfer agent MTA—1; catches MTA—0's IP address IP—0, MTA—0's declared domain D—0, from-address A—0; and to-address A—1; and uses this source and content based information to test for unsolicited messages. It interrupts the conversation when MTA—0 sends a command_specifying the recipient (an “RCPT” command) and uses the various test results to decide if the message is suspected of being unsolicited. If the message is suspected of being unsolicited then it logs the rejected message, sends an error reply to MTA—0 which forces MTA—0 to terminate the connection with MTA—1 before the body of the message is transmitted; else it logs the allowed message, releases the intercepted RCPT command which allows the conversation between MTA—0 and MTA—1 to proceed. ## Claims ### Claim 1 A method for determining if an e-mail message from a transmitting message transfer agent is unsolicited, the transmitting message transfer agent having an actual domain and the e-mail message comprising a from-address having a domain, the method comprising the steps of: determining whether the from-address domain is in a suspect domain database; and if the from-address domain is determined to be in the suspect_domain database, then determining whether the from-address domain is not the same as the actual domain, wherein the step of determining whether the from-address domain is not the same as the actual domain comprises identifying an Internet Protocol (IP) address of the transmitting message transfer agent, determining the actual domain associated with the IP address of the transmitting message transfer agent, and comparing the actual domain to the from-address domain, and wherein the e-mail message is determined to be unsolicited if the from-address domain is in the suspect domain database and the from-address domain is not the same as the actual domain. ### Claim 2 (depends on 1) The method of claim 1, further comprising relaying and monitoring SMTP messages exchanged between the transmitting message transfer agent and a receiving message transfer agent; intercepting a RCPT reply from the transmitting message transfer agent; and releasing the RCPT reply if the e-mail message is determined not to be unsolicited, whereas, sending an error reply to the transmitting message transfer agent if the e-mail message is determined to be unsolicited. ### Claim 3 (depends on 2) The method of claim 2, wherein the sending of the error reply occurs before a data portion of the unsolicited e-mail message is transmitted from the transmitting message transfer agent. ### Claim 4 (depends on 2) The method of claim 2, wherein the SMTP messages are not intercepted before the RCPT reply from the transmitting message transfer agent. ### Claim 5 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if an Internet Protocol (IP) address of the transmitting message transfer agent is in an allow address database. ### Claim 6 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if an Internet Protocol (IP) address of the transmitting message transfer agent is in a prevent address database. ### Claim 7 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if an Internet Protocol (IP) address of the transmitting message transfer agent is in an open relay database. ### Claim 8 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if an Internet Protocol address of the transmitting message transfer agent has a domain name entry in a domain name server (DNS) database. ### Claim 9 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if the from-address of the e-mail message is in a bad from database. ### Claim 10 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if the from-address of the e-mail message matches a to-address of the e-mail message. ### Claim 11 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if a to-address of the e-mail message is in a no filter database. ### Claim 12 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if a to-address of the e-mail message is in a yes filter database. ### Claim 13 The method of 2, wherein the receiving message transfer agent has a domain (D_1), and wherein the e-mail message is determined not to be unsolicited by checking if a declared domain of the transmitting message transfer agent is the same as D_1. ### Claim 14 The method of 2, wherein the e-mail message is determined not to be unsolicited by checking if a declared domain of the transmitting message transfer agent does not match the actual domain and the declared domain is in the suspect domain database. ### Claim 15 The method of 2, further comprising: logging the time, a from-address of the e-mail message, a to-address of the e-mail message, and a reason for sending the error reply in a rejected_connection database if the e-mail message is determined to be unsolicited. ### Claim 16 The method of 2, further comprising: logging the time and a to-address of the e-mail message in an allowed connection database if the e-mail message is determined not to be unsolicited. ### Claim 17 The method of 2, wherein in the error reply is a 550 error reply in accordance with the Simple Message Transfer Protocol (SMTP). ### Claim 18 An unsolicited message rejecting communications system for analyzing an electronic mail message purportedly sent from-address A_0 and to to-address A_1 to be communicated from a message transfer agent MTA_0 having an actual domain DD_0 to a message transfer agent MTA_1, said system comprising: a database comprising a suspect domain database; and a means for determining if the electronic mail message is unsolicited wherein the from-address A_0 comprises a domain and the electronic mail message is determined to be unsolicited if the domain is in the suspect domain database and the domain is not the same as the actual domain DD_0, wherein the means for determining further comprises a means for identifying an IP address of the message transfer agent MTA_0 when the domain is determined to be in the suspect domain database, a means for determining the actual domain DD_0 associated with the IP address of the message transfer agent when the domain is determined to be in the suspect domain database, and a means for comparing the actual domain DD_0 to the domain of the from-address A_0 when the domain is determined to be in the suspect domain database. ### Claim 19 (depends on 18) The system of claim 18 further comprising a relay and monitoring means for relaying and monitoring SMTP messages exchanged between the transmitting message transfer agent (MTA_0) and the receiving message transfer agent (MTA_1); means for intercepting a RCPT reply from MTA_0; means for releasing the RCPT reply if the e-mail message is determined not to be unsolicited, whereas, sending an error reply to MTA_0 if the e-mail message is determined to be unsolicited, wherein MTA_1 controls the interaction between MTA_0 and MTA_1 before the intercepting of the RCPT reply. ### Claim 20 (depends on 18) The system of claim 18, further comprising wherein the e-mail message is determined not to be unsolicited by checking if an Internet Protocol (IP) address of MTA_0 (IP_0) is in an allow address database. ### Claim 21 (depends on 18) The system of claim 18, further comprising wherein the e-mail message is determined not to be unsolicited by checking if an Internet Protocol (IP) address of MTA_0 (IP_0) is in a prevent_address database.