Email spam filtering is performed based on a combination of IP address and
domain. When an email message is received, an IP address and a domain
associated with the email message are determined. A cross product of the
IP address (or portions of the IP address) and the domain (or portions of
the domain) is calculated. If the email message is known to be either
spam or non-spam, then a spam score based on the known spam status is
stored in association with each (IP address, domain) pair element of the
cross product. If the spam status of the email message is not known, then
the (IP address, domain) pair elements of the cross product are used to
lookup previously determined spam scores. A combination of the previously
determined spam scores is used to determine whether or not to treat the
received email message as spam.