Recalling spam email or viruses from inboxes

A method for operating an improved spam filter apparatus for to recall spam email after transfer to an email server comprising:

• building a database of received email profiles;
• searching said database of received email profiles to identify spam, wherein searching comprises
• requesting an update of spam attributes from a reference,
• retrieving any message id having a match with a spam attribute;
• retrieving a recipient of an email having a spam attribute, wherein a spam attribute comprises a connecting IP address;
• and
• recalling a spam email having the spam attribute from the mailbox of the recipient by modifying at least one of a font, text, and icon of the spam email;
• wherein building a database of received email profiles comprises:
• receiving email,
• forwarding said email to an email server, and
• storing a message id and connecting IP address for each email forwarded to an email server, wherein the connecting IP address is not a source IP address, not a sender address, and not a mail-from field value.

An apparatus for building a database of received email profiles comprises

• a spam filter coupled to a wide area network, the spam filter further coupled to a received email profile database, wherein the spam filter comprises
• a network interface,
• a circuit to receive an email,
• a circuit to read at least a message id, at least one connecting Internet Protocol (IP) address, and a source IP address, and write into a searchable received email profile database,
• a circuit to transmit the email to an email server, and a processor and memory,
• wherein the spam filter is configured to search said received email profile database to identify spam by
• requesting an update of spam attributes from a reference,
• retrieving a message id having a match with one of the spam attributes, wherein the matched spam attribute comprises a connecting IP address;
• retrieving a recipient of an email having the matched spam attribute, and
• recalling the email having the matched spam attribute from the mailbox of the recipient by modifying at least one of a font, text, and icon of the spam email.