Network domain reputation-based spam filtering

TECHNICAL FIELD

0001This invention relates to spam filtering.

BACKGROUND

0002Electronic mail, also commonly referred to as “email” or “e-mail”, is increasingly utilized as an electronic form of communication via the Internet. Spam is unsolicited email often sent to email distribution lists that include a large number of users' email addresses. Spam is similar to telemarketing and is the electronic equivalent of “junk mail” used to advertise products and services, request charitable donations, or to broadcast some political or social commentary. Spamming is the practice of sending an unsolicited email message to large numbers of email addresses indiscriminately. Spam emails are often unwanted by the many recipients and are considered a waste of not only the recipients' time, but network bandwidth.

0003Spam email can also appear to be from a trusted site because a spammer can spoof the domain name from which the spam email originates. Domain spoofing is often used so that a recipient will think a spam email comes from a legitimate source. A recipient may be tricked into opening a spam email that is not from the trusted sender the email purports to be from. The SMTP (Simple Mail Transfer Protocol) does not authenticate the sender of an email message and a spam email from a spoofed domain name may not be detected as a spam email. For example, there is no guarantee that an email which appears to be from msn.com is actually from MSN.

0004SenderID is a particular authentication protocol for email designed to protect against domain spoofing. A spammer can forge, or spoof, the domain that an email purports to be from, but can not forge the IP (Internet protocol) address of the computer that sends an email message. For SenderID, a domain that sends email publishes a list of IP addresses of the computers that are allowed to send email for the domain. This list of IP addresses is stored as a TXT record in the DNS (Domain Name Server) system which is part of the Internet infrastructure and a repository of information about domains. The DNS system primarily maintains the mapping between symbolic domain names and corresponding IP addresses.

0005When an email message is received by an inbound email server, the server obtains the sending computer's IP address and extracts the domain that the email purports to be from. The domain that the email purports to be from is identified as the purported responsible domain (PRD). The inbound email server obtains the SenderID record for the PRD from the DNS and determines whether the IP address is on that list of IP addresses allowed to send email from the particular domain. If so, the sender has been authenticated. The authentication status can then be used to determine what to do and/or where to route the email message. The email can be deleted, delivered to the intended recipient's junk email folder, or delivered to the intended recipient's Inbox.

0006Although SenderID is a step forward to detect spam emails, SenderID on its own does not prevent spammers from generating and attempting to distribute spam emails. For example, a spammer can setup SenderID for a domain (e.g., publish a list of the server IP addresses associated with the domain to send out email) and then use the domain to send spam emails. A spam email from the spammer that owns the domain can be authenticated (e.g., passed as a legitimate email) because the email is communicated through a service provider that has an IP address matching the DNS record for the domain. However, an authenticated spam email is still an unwanted spam email.

0007Alternatively, an email that is not authenticated is not necessarily a spam email. The email may not be identifiable by SenderID, but instead may be communicated through a third-party service provider that is not currently recognized by the SenderID protocol. Accordingly, a SenderID “pass” does not always indicate that an email is a legitimate email, and a SenderID “fail” does not always indicate that an email is a spam email.

SUMMARY

0008Network domain reputation-based spam filtering is described herein.

0009In an implementation of network domain reputation-based spam filtering, emails are received from a network domain and a domain reputation of the network domain is established based on the determined spam status of the received emails. Additional emails are filtered as they are received to determine a status of each email as spam email or not spam email. An email can be determined to be a spam email based on any one or more of the reputation of the network domain, an authentication status of an email, and other information that can be derived from an email.

BRIEF DESCRIPTION OF THE DRAWINGS

0010The same numbers are used throughout the drawings to reference like features and components.

0011<figref idref="DRAWINGS">FIG. 1</figref> illustrates an exemplary email system in which embodiments of network domain reputation-based spam filtering can be implemented.

0012<figref idref="DRAWINGS">FIG. 2</figref> illustrates an exemplary network domain reputation-based spam filter.

0013<figref idref="DRAWINGS">FIG. 3</figref> illustrates an exemplary computing device that can be implemented as a client device or as an email server shown in <figref idref="DRAWINGS">FIG. 1</figref>, and in which embodiments of network domain reputation-based spam filtering can be implemented.

0014<figref idref="DRAWINGS">FIG. 4</figref> is a flow diagram that illustrates an exemplary method for network domain reputation-based spam filtering.

0015<figref idref="DRAWINGS">FIG. 5</figref> is a flow diagram that illustrates another exemplary method for network domain reputation-based spam filtering.

0016<figref idref="DRAWINGS">FIG. 6</figref> illustrates exemplary computing systems, devices, and components in an environment that network domain reputation-based spam filtering can be implemented.

DETAILED DESCRIPTION

0017Network domain reputation-based spam filtering is implemented to detect spam emails received from network domains. The reputation of an authenticated network domain can be established by evaluating emails that are received from the network domain and determining whether each of the emails is a spam email or not. Subsequent emails received from the network domain can be filtered as they are received and, based on the authentication result and established reputation of the network domain, a status of each email can be determined as a spam email or not a spam email. Additionally, the status of an email as a spam email or not a spam email can be determined based on an authentication status of the email and/or based on other information that can be derived from the email.

0018While aspects of the systems and methods described for network domain reputation-based spam filtering can be implemented in any number of different computing systems, environments, and/or configurations, embodiments of network domain reputation-based spam filtering are described in the context of the following exemplary system architectures.

0019<figref idref="DRAWINGS">FIG. 1</figref> illustrates an exemplary email system <b>100</b> in which embodiments of network domain reputation-based spam filtering can be implemented. The email system <b>100</b> includes network domains <b>102</b>(<b>1</b>-N) and an inbound email server <b>104</b> each configured for communication via a communication network <b>106</b>, such as the Internet. A network domain <b>102</b> and/or the inbound email server <b>104</b> may be implemented as any form of computing or electronic device with any number and combination of differing components as described below with reference to the exemplary computing environment <b>600</b> shown in <figref idref="DRAWINGS">FIG. 6</figref>.

0020In an implementation of the exemplary email system <b>100</b>, emails are generated at a network domain <b>102</b> and delivered to the inbound email server <b>104</b> for distribution to one or more client devices (not shown). For example, network domain <b>102</b>(<b>2</b>) (identified as BigCo.com) generates and communicates company emails <b>108</b> to the inbound email server <b>104</b> for distribution to client devices, such as to customers of the company. Similarly, network domain <b>102</b>(N) (identified as Bank.com) generates and communicates business emails <b>110</b> to the inbound email server <b>106</b> for distribution to client devices, such as to customers of the Bank.

0021In this example, network domain <b>102</b>(<b>1</b>) (identified as Spam2U.com) is a source of unwanted spam emails <b>112</b>, some of which are communicated to the inbound email server <b>106</b> for distribution to client devices, such as intended recipients of the spam emails <b>112</b>. The inbound email server <b>104</b> includes an anti-spam filter <b>114</b> which can be implemented with any number of different filters and inputs <b>116</b> to detect the spam emails <b>112</b> based on sender reputation and/or other information that can be derived from an email. The anti-spam filter <b>114</b> receives spam emails <b>118</b> (e.g., spam emails <b>112</b> from Spam2U.com) and business and company emails <b>120</b> (e.g., company emails <b>108</b> from BigCo.com and business emails <b>110</b> from Bank.com).

0022The anti-spam filter <b>114</b> can be implemented in an email server <b>104</b> to receive emails and to determine the status of an email as being a spam email or not a spam email based on the reputation of the sender of the email and/or based on other information that pertains to a received email. Examples of the other information that pertains to an email include an IP (Internet protocol) address of the computer that communicates the email message, an authentication status of the email (e.g., SenderID authentication), one or more message features derived from the text of the email, special features such as the time and day that the message was originated, and/or any combination thereof.

0023Although network domain reputation-based spam filtering is described with reference to email communications, alternative embodiments of reputation-based spam filtering can apply to any form of electronic messaging via which unwanted communications are distributed and received. For example, various embodiments of sender reputation-based spam filtering can be adapted for conferencing applications, chat programs, instant messaging, and for any other type of messaging system that can implement the spam filtering to detect unwanted text and messages.

0024<figref idref="DRAWINGS">FIG. 2</figref> illustrates an embodiment of a spam filter <b>200</b>, an example of which is the anti-spam filter <b>114</b> shown in <figref idref="DRAWINGS">FIG. 1</figref>. The spam filter <b>200</b> can include any combination of various filters and inputs from which the spam status of received emails can be determined. In this example, the spam filter <b>200</b> includes an authentication determination <b>202</b>, an authentication result filter <b>204</b>, a domain reputation filter <b>206</b>, an IP address filter <b>208</b>, a message features filter <b>210</b>, and weighted factor(s) <b>212</b>. The authentication determination <b>202</b> can be obtained from a SenderID authentication system, for example, or from any other similar email authenticating system. The authentication result filter <b>204</b> includes an authentication and email status correlation <b>214</b> that correlates a SenderID result with the status of an email message (e.g., spam or not spam).

0025Domain reputation filter <b>206</b> includes domain reputations <b>216</b> which each correspond to a particular network domain <b>102</b>. A reputation <b>216</b> for an authenticated domain can be established by evaluating emails that are received from a particular network domain <b>102</b> along with the sender authentication determination <b>202</b>, and determining whether each of the emails is a spam email or not. Alternatively and/or in addition, a domain reputation can be established via a statistical machine learning process. Each domain reputation <b>216</b> is a learned reputation that is established separately for each respective network domain that sends out emails. For example, a domain reputation <b>216</b> corresponds to network domain <b>102</b>(<b>1</b>) and identifies Spam2U.com as having a bad reputation for generating unwanted spam emails. Similarly, domain reputations <b>216</b> each correspond to respective network domains <b>102</b>(<b>2</b>) and <b>102</b>(N) and identify BigCo.com and Bank.com as having a good reputation for generating company and/or business emails that are not spam emails.

0026The term “bad” is merely descriptive and used herein to describe the reputation of a particular network domain that typically generates spam emails. A network domain that has a “bad” reputation generally sends out, or originates, more spam email communications than a particular network domain that has a “good” reputation for not generating unwanted spam email communications. Any other comparison-based terminology or numerology can be utilized to indicate the reputation of a network domain that generates unwanted spam emails when compared to the reputation of a network domain that does not generate spam emails.

0027The IP address filter <b>208</b> includes IP address reputations <b>218</b> which each correspond to a particular computer that originates, or sends out, an email from a network domain. For example, an IP address reputation <b>218</b> corresponds to a computer that sends out emails from domain <b>102</b>(<b>1</b>) and identifies the domain computer as having a bad reputation for communicating spam emails <b>112</b> from network domain <b>102</b>(<b>1</b>).

0028The message features filter <b>210</b> includes content and features filters <b>220</b> which each correspond to a particular message feature of received emails. A content filter <b>220</b> can correspond to words, a combination of words, and/or character strings in an email message, such as “debt”, “lose weight”, “free quote”, and the like which likely indicate a spam email. In addition, a message feature in a filter <b>220</b> can correspond to the time of day and/or the day of a week that an email is sent, the size of the email, the subject of the email, the number of recipients that the email is addressed to, and/or any number of other message features.

0029The weighted factor(s) <b>212</b> receives inputs <b>222</b> from one or more of the authentication result filter <b>204</b>, domain reputation filter <b>206</b>, IP address filter <b>208</b>, and message features filter <b>210</b>. An output <b>224</b> of the weighted factors <b>212</b> is any combination of the one or more inputs <b>222</b>. The weighted factors <b>212</b> assign a reputation factor, or weight, to any combination of the inputs <b>222</b> to establish a weight for each input or combination of inputs that can be utilized as a component of the spam filter <b>200</b>. The weighted factors <b>212</b> are learned and established over a time duration, and can be utilized as a fallback for those network domains that communicate emails but are not registered with SenderID.

0030An email status <b>226</b> of a received email is determined to be either spam or not spam based on input <b>224</b> from the weighted factors <b>212</b>. In an embodiment, input <b>224</b> is derived from weighted factors <b>212</b> as a score <b>228</b>, and the status <b>226</b> of an email is based on the score corresponding to the email.

0031<figref idref="DRAWINGS">FIG. 3</figref> illustrates various components of an exemplary computing device <b>300</b> in which embodiments of network domain reputation-based spam filtering can be implemented. Exemplary computing device <b>300</b> can be implemented as a client device, or can be implemented as the inbound email server <b>104</b> in the exemplary email system <b>100</b> described with reference to <figref idref="DRAWINGS">FIG. 1</figref>. Computing device <b>300</b> can also be implemented as any form of computing or electronic device with any number and combination of differing components as described below with reference to the exemplary computing environment <b>600</b> shown in <figref idref="DRAWINGS">FIG. 6</figref>.

0032Computing device <b>300</b> includes one or more media content inputs <b>302</b> which may include Internet Protocol (IP) inputs over which streams of media content are received via an IP-based network. Computing device <b>300</b> further includes communication interface(s) <b>304</b> which can be implemented as any one or more of a serial and/or parallel interface, a wireless interface, any type of network interface, and as any other type of communication interface. A wireless interface enables computing device <b>300</b> to receive control input commands and other information from an input device, such as from a remote control device or from another infrared (IR), 802.11, Bluetooth, or similar RF input device.

0033A network interface provides a connection between computing device <b>300</b> and a communication network (e.g., network <b>106</b> shown in <figref idref="DRAWINGS">FIG. 1</figref>) by which other electronic and computing devices can communicate data with computing device <b>300</b>. Similarly, a serial and/or parallel interface provides for data communication directly between computing device <b>300</b> and the other electronic or computing devices.

0034Computing device <b>300</b> also includes one or more processors <b>306</b> (e.g., any of microprocessors, controllers, and the like) which process various computer executable instructions to control the operation of computing device <b>300</b>, to communicate with other electronic and computing devices, and to implement embodiments of network domain reputation-based spam filtering. Computing device <b>300</b> can be implemented with computer readable media <b>308</b>, such as one or more memory components, examples of which include random access memory (RAM), non-volatile memory (e.g., any one or more of a read-only memory (ROM), flash memory, EPROM, EEPROM, etc.), and a disk storage device. A disk storage device can include any type of magnetic or optical storage device, such as a hard disk drive, a recordable and/or rewriteable compact disc (CD), a DVD, a DVD+RW, and the like.

0035Computer readable media <b>308</b> provides data storage mechanisms to store various information and/or data such as software applications and any other types of information and data related to operational aspects of computing device <b>300</b>. For example, an operating system <b>310</b>, other application programs <b>312</b>, and an embodiment of a spam filter <b>314</b> can be maintained as software applications with the computer readable media <b>308</b> and executed on processor(s) <b>306</b> to implement embodiments of network domain reputation-based spam filtering. Examples of the spam filter <b>314</b> include anti-spam filter <b>118</b> shown in <figref idref="DRAWINGS">FIG. 1</figref> and the spam filter <b>200</b> shown in <figref idref="DRAWINGS">FIG. 2</figref>.

0036Application programs <b>312</b> can include a browser application <b>316</b> and an email application <b>318</b> when computing device <b>300</b> is implemented as a client device. The email application <b>318</b> facilitates email communication and provides a user interface through which a user can interact with a mail service provider and/or the inbound email server <b>106</b>.

0037Computing device <b>300</b> also includes an audio and/or video input/output <b>320</b> that provides audio and video to an audio rendering and/or display device <b>322</b>, or to other devices that process, display, and/or otherwise render audio, video, and display data. Video signals and audio signals can be communicated from computing device <b>300</b> to display device <b>322</b> via an RF (radio frequency) link, S-video link, composite video link, component video link, analog audio connection, or other similar communication links.

0038Although shown separately, some of the components of computing device <b>300</b> may be implemented in an application specific integrated circuit (ASIC). Additionally, a system bus (not shown) typically connects the various components within computing device <b>300</b>. A system bus can be implemented as one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, or a local bus using any of a variety of bus architectures.

0039Methods for network domain reputation-based spam filtering, such as exemplary methods <b>400</b> and <b>500</b> described with reference to respective <figref idref="DRAWINGS">FIGS. 4 and 5</figref>, may be described in the general context of computer executable instructions. Generally, computer executable instructions can include routines, programs, objects, components, data structures, procedures, modules, functions, and the like that perform particular functions or implement particular abstract data types. The methods may also be practiced in a distributed computing environment where functions are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, computer executable instructions may be located in both local and remote computer storage media, including memory storage devices.

0040<figref idref="DRAWINGS">FIG. 4</figref> illustrates an exemplary method <b>400</b> for network domain reputation-based spam filtering and is described with reference to the exemplary email system <b>100</b> and the spam filters <b>118</b> and <b>200</b> shown in respective <figref idref="DRAWINGS">FIGS. 1 and 2</figref>. The order in which the method is described is not intended to be construed as a limitation, and any number of the described method blocks can be combined in any order to implement the method. Furthermore, the method can be implemented in any suitable hardware, software, firmware, or combination thereof.

0041At block <b>402</b>, emails are received from a network domain. For example, inbound email server <b>104</b> (<figref idref="DRAWINGS">FIG. 1</figref>) receives company emails <b>108</b> (e.g., not spam emails) from network domain <b>102</b>(<b>2</b>), and receives spam emails <b>112</b> from network domain <b>102</b>(<b>1</b>). At block <b>404</b>, a reputation of the network domain is established based on an authentication determination and the spam status (spam or not spam) of the emails received from the network domain. For example, a domain reputation <b>216</b> (<figref idref="DRAWINGS">FIG. 2</figref>) is established for a particular network domain <b>102</b> by evaluating emails that are received from the network domain <b>102</b> and determining whether each of the emails is a spam email or not. Separate domain reputations <b>216</b> are established for each combination of an authentication determination <b>202</b> and purported domain <b>102</b> from which an email is originated.

0042At block <b>406</b>, additional emails are received from the network domain. At block <b>408</b>, the additional emails are filtered to determine a status of each email as spam email or not spam email. The status of an email can be determined based on the reputation of the network domain, based on an authentication determination of the email, based on the reputation of the network domain and a message feature of the email, based on the reputation of the network domain and a computing device via which the additional emails are received from the network domain, and/or any combination thereof. For example, an email can be received by each of the authentication result filter <b>204</b>, domain reputation filter <b>206</b>, IP address filter <b>208</b>, and/or message features filter <b>210</b> for input to weighted factors <b>212</b> which generates a score <b>228</b> from which an email status <b>226</b> is determined.

0043<figref idref="DRAWINGS">FIG. 5</figref> illustrates an exemplary method <b>500</b> for network domain reputation-based spam filtering and is described with reference to the exemplary email system <b>100</b> and the spam filters <b>118</b> and <b>200</b> shown in respective <figref idref="DRAWINGS">FIGS. 1 and 2</figref>. The order in which the method is described is not intended to be construed as a limitation, and any number of the described method blocks can be combined in any order to implement the method. Furthermore, the method can be implemented in any suitable hardware, software, firmware, or combination thereof.

0044At block <b>502</b>, an email is received from a network domain. For example, inbound email server <b>104</b> (<figref idref="DRAWINGS">FIG. 1</figref>) receives company emails <b>108</b> (e.g., not spam emails) from network domain <b>102</b>(<b>2</b>), receives business emails <b>110</b> (e.g., not spam emails) from network domain <b>102</b>(N), and receives spam emails <b>112</b> from network domain <b>102</b>(<b>1</b>). At block <b>504</b>, an authentication determination of the email is determined. For example, authentication determination <b>202</b> receives the email and returns an authentication result code. For SenderID, results codes include Pass, Fail, Neutral, Softfail, TempError, PermError, and None. Exemplary method <b>500</b> can authenticate an email received from a network domain <b>102</b> using SenderID, but is not limited to this authentication method.

0045At block <b>506</b>, a network domain score of the email is determined via a domain reputation filter. For example, domain reputation filter <b>206</b> compares the network domain from which the received email originated to a domain reputation <b>216</b> corresponding to the network domain to determine a score of the email based on the network domain reputation <b>216</b>.

0046At block <b>508</b>, an IP address spam score of the email is determined via an IP address filter. For example, IP address filter <b>208</b> compares an IP address of a computing device in the network domain via which the email is received from the network domain to an IP address reputation <b>218</b> corresponding to the computing device to determine a score of the email based on the IP address reputation <b>218</b>.

0047At block <b>510</b>, a message score of the email is determined via a message feature filter. For example, message features filter <b>210</b> compares a message feature of the received email to a message feature reputation <b>220</b> corresponding to the message feature of the received email to determine a score of the email based on the message feature reputation <b>220</b>.

0048At block <b>512</b>, a weighted status of the email is determined via weighted factor(s). For example, one or more outputs of the authentication result filter <b>204</b>, domain reputation filter <b>206</b>, IP address filter <b>208</b>, and message features filter <b>210</b> are input <b>222</b> to the weighted factors <b>212</b>. An output <b>224</b> of the weighted factor(s) <b>212</b> is determined as any one or combination of the inputs <b>222</b>. A status <b>226</b> of the received email can be determined based on the weighted factor(s) <b>212</b> and a score <b>228</b> corresponding to the received email.

0049At block <b>514</b>, an overall status of the email is determined as a spam email or not a spam email based on any one or more of the inputs. For example, any combination of the authentication score (block <b>504</b>), the network domain score (block <b>506</b>), the IP address score (block <b>508</b>), the message score (block <b>510</b>), and/or the weighted score (block <b>512</b>) is combined to determine an overall email status <b>226</b> of the email.

0050<figref idref="DRAWINGS">FIG. 6</figref> illustrates an exemplary computing environment <b>600</b> within which network domain reputation-based spam filtering systems and methods, as well as the computing, network, and system architectures described herein, can be either fully or partially implemented. Exemplary computing environment <b>600</b> is only one example of a computing system and is not intended to suggest any limitation as to the scope of use or functionality of the architectures. Neither should the computing environment <b>600</b> be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary computing environment <b>600</b>.

0051The computer and network architectures in computing environment <b>600</b> can be implemented with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use include, but are not limited to, personal computers, server computers, client devices, hand-held or laptop devices, microprocessor-based systems, multiprocessor systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, gaming consoles, distributed computing environments that include any of the above systems or devices, and the like.

0052The computing environment <b>600</b> includes a general-purpose computing system in the form of a computing device <b>602</b>. The components of computing device <b>602</b> can include, but are not limited to, one or more processors <b>604</b> (e.g., any of microprocessors, controllers, and the like), a system memory <b>606</b>, and a system bus <b>608</b> that couples the various system components. The one or more processors <b>604</b> process various computer executable instructions to control the operation of computing device <b>602</b> and to communicate with other electronic and computing devices. The system bus <b>608</b> represents any number of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures.

0053Computing environment <b>600</b> includes a variety of computer readable media which can be any media that is accessible by computing device <b>602</b> and includes both volatile and non-volatile media, removable and non-removable media. The system memory <b>606</b> includes computer readable media in the form of volatile memory, such as random access memory (RAM) <b>610</b>, and/or non-volatile memory, such as read only memory (ROM) <b>612</b>. A basic input/output system (BIOS) <b>614</b> maintains the basic routines that facilitate information transfer between components within computing device <b>602</b>, such as during start-up, and is stored in ROM <b>612</b>. RAM <b>610</b> typically contains data and/or program modules that are immediately accessible to and/or presently operated on by one or more of the processors <b>604</b>.

0054Computing device <b>602</b> may include other removable/non-removable, volatile/non-volatile computer storage media. By way of example, a hard disk drive <b>616</b> reads from and writes to a non-removable, non-volatile magnetic media (not shown), a magnetic disk drive <b>618</b> reads from and writes to a removable, non-volatile magnetic disk <b>620</b> (e.g., a “floppy disk”), and an optical disk drive <b>622</b> reads from and/or writes to a removable, non-volatile optical disk <b>624</b> such as a CD-ROM, digital versatile disk (DVD), or any other type of optical media. In this example, the hard disk drive <b>616</b>, magnetic disk drive <b>618</b>, and optical disk drive <b>622</b> are each connected to the system bus <b>608</b> by one or more data media interfaces <b>626</b>. The disk drives and associated computer readable media provide non-volatile storage of computer readable instructions, data structures, program modules, and other data for computing device <b>602</b>.

0055Any number of program modules can be stored on RAM <b>610</b>, ROM <b>612</b>, hard disk <b>616</b>, magnetic disk <b>620</b>, and/or optical disk <b>624</b>, including by way of example, an operating system <b>628</b>, one or more application programs <b>630</b>, other program modules <b>632</b>, and program data <b>634</b>. Each of such operating system <b>628</b>, application program(s) <b>630</b>, other program modules <b>632</b>, program data <b>634</b>, or any combination thereof, may include one or more embodiments of the systems and methods described herein.

0056Computing device <b>602</b> can include a variety of computer readable media identified as communication media. Communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” refers to a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, other wireless media, and/or any combination thereof.

0057A user can interface with computing device <b>602</b> via any number of different input devices such as a keyboard <b>636</b> and pointing device <b>638</b> (e.g., a “mouse”). Other input devices <b>640</b> (not shown specifically) may include a microphone, joystick, game pad, controller, satellite dish, serial port, scanner, and/or the like. These and other input devices are connected to the processors <b>604</b> via input/output interfaces <b>642</b> that are coupled to the system bus <b>608</b>, but may be connected by other interface and bus structures, such as a parallel port, game port, and/or a universal serial bus (USB).

0058A display device <b>644</b> (or other type of monitor) can be connected to the system bus <b>608</b> via an interface, such as a video adapter <b>646</b>. In addition to the display device <b>644</b>, other output peripheral devices can include components such as speakers (not shown) and a printer <b>648</b> which can be connected to computing device <b>602</b> via the input/output interfaces <b>642</b>.

0059Computing device <b>602</b> can operate in a networked environment using logical connections to one or more remote computers, such as remote computing device <b>650</b>. By way of example, remote computing device <b>650</b> can be a personal computer, portable computer, a server, a router, a network computer, a peer device or other common network node, and the like. The remote computing device <b>650</b> is illustrated as a portable computer that can include any number and combination of the different components, elements, and features described herein relative to computing device <b>602</b>.

0060Logical connections between computing device <b>602</b> and the remote computing device <b>650</b> are depicted as a local area network (LAN) <b>652</b> and a general wide area network (WAN) <b>654</b>. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets, and the Internet. When implemented in a LAN networking environment, the computing device <b>602</b> is connected to a local network <b>652</b> via a network interface or adapter <b>656</b>. When implemented in a WAN networking environment, the computing device <b>602</b> typically includes a modem <b>658</b> or other means for establishing communications over the wide area network <b>654</b>. The modem <b>658</b> can be internal or external to computing device <b>602</b>, and can be connected to the system bus <b>608</b> via the input/output interfaces <b>642</b> or other appropriate mechanisms. The illustrated network connections are merely exemplary and other means of establishing communication link(s) between the computing devices <b>602</b> and <b>650</b> can be utilized.

0061In a networked environment, such as that illustrated with computing environment <b>600</b>, program modules depicted relative to the computing device <b>602</b>, or portions thereof, may be stored in a remote memory storage device. By way of example, remote application programs <b>660</b> are maintained with a memory device of remote computing device <b>650</b>. For purposes of illustration, application programs and other executable program components, such as operating system <b>628</b>, are illustrated herein as discrete blocks, although it is recognized that such programs and components reside at various times in different storage components of the computing device <b>602</b>, and are executed by the one or more processors <b>604</b> of the computing device <b>602</b>.

0062Although embodiments of network domain reputation-based spam filtering have been described in language specific to structural features and/or methods, it is to be understood that the subject of the appended claims is not necessarily limited to the specific features or methods described. Rather, the specific features and methods are disclosed as exemplary implementations of network domain reputation-based spam filtering.