Method and apparatus for scoring unsolicited e-mail

1. A method for identifying and marking each email in one or more sets of similar emails from a plurality of emails, received on a number of different recipient email addresses within a specified period of time at a single server, as spam comprising:

establishing a first plurality of e-mail address categories for a single email server;

assigning a weight to each of the first plurality of email address categories;

creating a table containing the plurality of e-mail address categories and a second plurality of weights, each weight corresponding to a single email category;

establishing a third plurality of email attributes;

establishing a threshold;

tracking a fourth plurality of emails on an alias basis for the single email server;

building a database for the single email server showing a fifth plurality of values for each email corresponding to the third plurality of email attributes;

using the database, determining one or more sets of similar emails by identifying those emails in the database having the same attributes and the same values for each of the same attributes;

using the table, determining a weight for each email address in the one or more sets of similar email addresses;

calculating a score for each set of similar emails by adding together each weight for each email address in each set;

placing the score in the header of each email in the set;

determining if the score exceeds the threshold;

when the score exceeds the threshold, tagging each email with the score in the header as spam;

wherein each email in the one or more sets of similar emails from the plurality of emails, received on the number of different recipient email addresses within the specified period of time, is marked as spam.