Filtering network traffic from automated scanners

1. A method for filtering network traffic at an application server, comprising:

receiving an activity message associated with an interaction between a source network address and an electronic communication message;

identifying, from the activity message, at least a source identifier for the source network address and one or more attributes associated with the electronic communication message;

adding the activity message to a mapping of source identifiers and attributes associated with previously received activity messages received during a previous time window;

comparing the activity message to a plurality of interactions in accordance with the mapping, wherein the plurality of interactions is between the source network address and a plurality of electronic communication messages within the previous time window;

classifying the source network address as an automated scanner based at least in part on identifying, in accordance with the comparing, a pattern of interactions of the source network address with the plurality of electronic communication messages within the previous time window; and

transmitting, to an external server, a classification result based at least in part on classifying the source network address.

2. The method of claim 1 , further comprising:

identifying, from the activity message, a timestamp associated with the electronic communication message; and

determining that the timestamp corresponds to the previous time window, wherein adding the activity message comprises adding the activity message to the mapping associated with the previous time window.

3. The method of claim 2 , further comprising:

determining the previous time window based at least in part on the timestamp associated with the electronic communication message.

4. The method of claim 1 , further comprising:

determining one or more signals associated with the source identifier of the activity message based at least in part on the mapping of source identifiers and the attributes associated with the previously received activity messages, wherein classifying the source network address is based at least in part on the one or more signals.

5. The method of claim 4 , further comprising:

identifying a plurality of activity messages associated with the source identifier within the previous time window, wherein the plurality of activity messages include the plurality of interactions of the source identifier with the plurality of electronic communication messages; and

determining the one or more signals based at least in part on the plurality of activity messages associated with the source identifier within the previous time window.

6. The method of claim 5 , wherein the plurality of interactions of the source identifier comprise opening of the plurality of electronic communication messages within the previous time window.

7. The method of claim 5 , wherein the plurality of interactions of the source identifier comprise the plurality of interactions with a plurality of customers associated with the plurality of electronic communication messages.

8. The method of claim 5 , wherein the plurality of interactions of the source identifier comprise the plurality of interactions with a link included in one or more of the plurality of electronic communication messages.

9. The method of claim 5 , wherein the plurality of interactions of the source identifier comprise the plurality of interactions with a link included in one or more of the plurality of electronic communication messages, the one or more of the plurality of electronic communication messages being associated with one or more customers.

10. The method of claim 1 , further comprising:

receiving a classification request from the external server, wherein classifying the source network address is based at last in part on the classification request.

11. The method of claim 1 , wherein the source identifier of the activity message comprises an Internet Protocol (IP) address associated with the activity message.

12. The method of claim 1 , wherein the one or more attributes associated with the electronic communication message comprises at least one of an account identifier associated with the electronic communication message, an electronic communication message identifier, a timestamp associated with the electronic communication message, an identifier associated with a type of activity, or a combination thereof.

13. The method of claim 1 , wherein the automated scanner comprises an email security scanner.

14. An apparatus for filtering network traffic at an application server, comprising: a processor, memory coupled with the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to:

receive an activity message associated with an interaction between a source network address and an electronic communication message;

identify, from the activity message, at least a source identifier for the source network address and one or more attributes associated with the electronic communication message;

add the activity message to a mapping of source identifiers and attributes associated with previously received activity messages received during a previous time window;

compare the activity message to a plurality of interactions in accordance with the mapping, wherein the plurality of interactions is between the source network address and a plurality of electronic communication messages within the previous time window;

classify the source network address as an automated scanner based at least in part on identifying, in accordance with the comparing, a pattern of interactions of the source network address with the plurality of electronic communication messages within the previous time window; and

transmit, to an external server, a classification result based at least in part on classifying the source network address.

15. The apparatus of claim 14 , wherein the instructions are further executable by the processor to cause the apparatus to:

identify, from the activity message, a timestamp associated with the electronic communication message; and

the instructions to determine that the timestamp corresponds to the previous time window, wherein adding the activity message are executable by the processor to cause the apparatus to add the activity message to the mapping associated with the previous time window.

16. The apparatus of claim 15 , wherein the instructions are further executable by the processor to cause the apparatus to:

determine the previous time window based at least in part on the timestamp associated with the electronic communication message.

17. The apparatus of claim 14 , wherein the instructions are further executable by the processor to cause the apparatus to:

determine one or more signals associated with the source identifier of the activity message based at least in part on the mapping of source identifiers and the attributes associated with the previously received activity messages, wherein classifying the source network address is based at least in part on the one or more signals.

18. The apparatus of claim 17 , wherein the instructions are further executable by the processor to cause the apparatus to:

identify a plurality of activity messages associated with the source identifier within the previous time window, wherein the plurality of activity messages include the plurality of interactions of the source identifier with the plurality of electronic communication messages; and

determine the one or more signals based at least in part on the plurality of activity messages associated with the source identifier within the previous time window.

19. A non-transitory computer-readable medium storing code for filtering network traffic at an application server, the code comprising instructions executable by a processor to:

receive an activity message associated with an interaction between a source network address and with an electronic communication message;

identify, from the activity message, at least a source identifier for the source network address and one or more attributes associated with the electronic communication message;

add the activity message to a mapping of source identifiers and attributes associated with previously received activity messages received during a previous time window;

compare the activity message to a plurality of interactions in accordance with the mapping, wherein the plurality of interactions is between the source network address and a plurality of electronic communication messages within the previous time window;

classify the source network address as an automated scanner based at least in part on identifying, in accordance with the comparing, a pattern of interactions of the source network address with the plurality of electronic communication messages within the previous time window; and

transmit, to an external server, a classification result based at least in part on classifying the source network address.

20. The non-transitory computer-readable medium of claim 19 , wherein the instructions are further executable to:

identify, from the activity message, a timestamp associated with the electronic communication message; and

determine that the timestamp corresponds to the previous time window.