Kelkea was founded in 1996 as the Mail Abuse Prevention System. MAPS was one of the first anti-spam companies, and operates perhaps the best-known real-time blackhole list (RBL), used by ISPs and enterprises to block spam.

The acquisition means Trend has got its hands on source-based filtering technology. As opposed to content-based filtering, source filtering can block threats at the network level without the need for processor-intensive content scanning.

Up to 85% of spam can be intercepted at the network layer, which offers tremendous benefits to customers, Trend chief executive Eva Chen told ComputerWire.

The gateway approach requires a lot of server resources and admin time, said Fernando Rynne, Trend Micro’s global product marketing manager.

Kelkea’s IP address database has been built up over the past eight years, and is thought to be the largest in the world, with ratings for more than 1.5 billion IP addresses.

Indeed, the database is used by some of the largest global ISPs including AOL, RoadRunner, USA.net, BT, Telstra and Telia Sonera.

The acquisition could be interpreted as a snub to Postini, which has been providing Trend with its spam filtering technology for two years and is currently pushing technology very similar to what Kelkea provides.

We’ve always believed that threats should be stopped at the network layer, and Postini is more at the content filtering layer, Trend’s Chen said.

In fact, Postini has been talking up its own source-based filtering as a core competency for some time and, as we reported on Monday, is currently talking to partners about licensing its reputation service data feeds.

The company confirmed that it had offered to license Trend its Postini Threat Information Network, PTIN, earlier this year, but that Trend declined.

Obviously it pains Postini that Trend didn’t understand the value in their superior technology, but they are happy to have a partner like Trend using their PASE (Postini Anti-Spam Engine) content filtering technology, a Postini spokesperson said.

The company, in an emailed statement, also contrasted the old MAPS RBL to its own PTIN offering, which it said is more up to date and reliable.

Contrary to their name, RBLs are not, in fact, real-time at all, but are static lists of offending IP addresses that are slow to add, and even slower to remove, IP addresses, the company said. Postini processes 500 million messages every day, so their realtime database of offending IP’s is comprehensive and up-to-the-second.

Rand and Chen said that Kelkea’s services are not confined to anti-spam. The same IP reputation database can be used to block phishing web sites, as well as the email phishes themselves, Chen said.

In the next 18 months, we are going to see new forms of attack that attack the internet infrastructure itself, Rand said, referring to false IP address advertising that could be used to trick users into visiting the wrong server.

Anyone on the internet can take over any IP address on the internet, Rand said. He said that such attacks are on the rise, and that Kelkea has seen thousands of examples of spoofing attacks, conducted mainly by spammers.

Kelkea employs approximately 20 people, and has an annual revenue stream in the $1m to $2m region. Most employees are expected to remain with the company, and its San Jose office will be retained and rebranded as Trend Micro San Jose.

Rand has been named chief technologist of internet content security at Trend Micro. According to Rynne, Trend Micro will initially offer Kelkea’s existing services under its own brand name, and will continue to support all of Kelkea’s current customers.

Trend Micro is based in Tokyo, Japan, and its products are mainly sold through value-added resellers and managed service providers worldwide.

It is not overly acquisitive, but last month it paid $15m for independent anti-spyware developer InterMute. Before that, in June 2003, it paid $400,000 for the CyberWallPlus technology from Network-1 Security Solutions. Terms of this latest deal were not disclosed.