Email anti-phishing inspector

• US 20060101120A1
• Filed: 11/10/2004
• Published: 05/11/2006
• Est. Priority Date: 11/10/2004
• Status: Active Grant

• Current Assignee: Digital Envoy, Inc. (Landmark Media Enterprises LLC)
• Original Assignee: Digital Envoy, Inc. (Landmark Media Enterprises LLC)
• Inventors: Friedman, Robert, Helsper, David, Burdette, Jeff
• Granted Patent: US 8,032,594 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/109 Time management, e.g. calendars, reminders, meetings or time accounting
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An application and system for inspecting an email message to determine if the email message is being used in a phishing ploy. When an email recipient receives an email message, the email message is sent to an EScam server for inspection. During its inspection, the EScam server considers various criteria, such as an originating country for an IP address associated with a sender of the email message, and assigns a score to the email message. Based on the score of the email message and threshold levels set within the EScam server, an email client determines whether the email message is part of a phishing ploy or a legitimate email message.

Claims

1. A method of determining a phishing email comprising:

receiving an email message;

determining a geographic location of origination for the email message;

scoring the email message based on results from the determination step; and

comparing the score with a predetermined phishing threshold score.

2. The method of claim 1, wherein if the score is above the predetermined phishing threshold score, the email message is concluded to be a phishing email.

3. The method of claim 2, wherein the conclusion occurs in real time.

4. The method of claim 1 further comprising parsing the email message into a header and a body.

5. The method of claim 4 further comprising removing an email address from the email message that is associated with a sender of the email message.

6. The method of claim 4 further comprising removing an email address from the email message that is associated with a receiver of the email message.

7. The method of claim 1 further comprising processing the email message.

8. The method of claim 1, wherein said email message is a HTML email message.

9. The method of claim 1, wherein said email message is a text email message.

10. The method of claim 1 further comprising retrieving a URL from the email message.

11. The method of claim 1, wherein the analysis step occurs within an EScam server.

12. The method of claim 11, wherein the EScam server uses an email scoring algorithm.

13. The method of claim 1, wherein the score is comprised of a header score and a URL score.

14. The method of claim 13, wherein the URL score is adjusted based on a HTML tag associated with the URL.

15. The method of claim 13, wherein the header score is adjusted based on an originating country associated with an IP address included within the email message.

16. The method of claim 1, wherein the email message is received from Microsoft Outlook.

17. The method of claim 16, wherein the detecting method is included in Microsoft Outlook as an add-in.

18. The method of claim 1, wherein the detecting method occurs before the email message is sent to an email recipient'"'"'s Inbox.

19. The method of claim 1 further comprising reporting information associated with the determination step.

20. The method of claim 1, wherein the determination step extracts an IP address from a header.

21. The method of claim 1, wherein the determination step uses attributes within the email message.

22. A computer based medium, comprising:

an application being executable by a computer, wherein the computer executes the steps of;

receiving an email message;

determining a geographic location of origination for the email message;

scoring the email message based on results from the determination step; and

comparing the score with a predetermined phishing threshold score.

23. The computer based medium of claim 22, wherein if the score is above the predetermined phishing threshold score, the email message is concluded to be a phishing email.

24. The computer based medium of claim 23, wherein the conclusion occurs in real time.

25. The computer based medium of claim 22 further comprising parsing the email message into a header and a body.

26. The computer based medium of claim 25 further comprising removing an email address from the email message that is associated with a sender of the email message.

27. The computer based medium of claim 25 further comprising removing an email address from the email message that is associated with a receiver of the email message.

28. The computer based medium of claim 22 further comprising processing the email message.

29. The computer based medium of claim 22, wherein said email message is a HTML email message.

30. The computer based medium of claim 22, wherein said email message is a text email message.

31. The computer based medium of claim 22 further comprising retrieving a URL from the email message.

32. The computer based medium of claim 22, wherein the analysis step occurs within an EScam server.

33. The computer based medium of claim 32, wherein the EScam server uses an email scoring algorithm.

34. The computer based medium of claim 22, wherein the score is comprised of a header score and a URL score.

35. The computer based medium of claim 34, wherein the URL score is adjusted based on a HTML tag associated with the URL.

36. The computer based medium of claim 34, wherein the header score is adjusted based on an originating country associated with an IP address included within the email message.

37. The computer based medium of claim 22, wherein the email message is received from Microsoft Outlook.

38. The computer based medium of claim 37, wherein the detecting method is included in Microsoft Outlook as an add-in.

39. The computer based medium of claim 22, wherein the email message is received from a UNIX based email server.

40. The computer based medium of claim 22, wherein the computer executes the steps before the email message is sent to an email recipient'"'"'s Inbox.

41. The computer based medium of claim 22 further comprising reporting information associated with the determination step.

42. The computer based medium of claim 22, wherein the determination step extracts an IP address from a header.

43. The computer based medium of claim 22, wherein the determination steps uses attributes within the email message.

44. A system for determining a phishing email comprising:

a computer system including a processor for executing computer code; and

an application for execution on the computer system, wherein the computer system, when executing the application receives an email message, determines a geographic location of origination for the email message, assigns a score to the email message based on results from the determination and compares the score with a predetermined phishing threshold score.

45. The system of claim 44, wherein the application is a web based application.

46. The system of claim 44, wherein if the score is above the predetermined phishing threshold score, the email message is determined to be a phishing email.

47. The system of claim 46, wherein the phishing determination occurs in real time.

48. The system of claim 44 further comprising parsing the email message into a header and a body.

49. The system of claim 48 further comprising removing an email address from the email message that is associated with a sender of the email message.

50. The system of claim 48 further comprising removing an email address from the email message that is associated with a receiver of the email message.

51. The system of claim 44 further comprising processing the email message.

52. The system of claim 44, wherein said email message is a HTML email message.

53. The system of claim 44, wherein said email message is a text email message.

54. The system of claim 44 further comprising retrieving a URL from the email message.

55. The system of claim 44, wherein the determination occurs within an EScam server.

56. The system of claim 55, wherein the EScam server uses an email scoring algorithm.

57. The system of claim 44, wherein the score is comprised of a header score and a URL score.

58. The system of claim 57, wherein the URL score is adjusted based on a HTML tag associated with the URL.

59. The system of claim 57, wherein the header score is adjusted based on an originating country associated with an IP address included within the email message.

60. The system of claim 44, wherein the email message is received from Microsoft Outlook.

61. The system of claim 60, wherein the detecting method is included in Microsoft Outlook as an add-in.

62. The system of claim 44, wherein the email message is received from a UNIX based email server.

63. The system of claim 44, wherein the phishing determination occurs before the email message is sent to an email recipient'"'"'s Inbox.

64. The system of claim 44 further comprising reporting information associated with the determination.

65. The system of claim 44, wherein the determination extracts an IP address from a header.

66. The system of claim 44, wherein the determination uses attributes within the email message.

67. A system for determining a phishing email comprising:

means for receiving an email message;

means for determining a geographic location of origination for the email message;

means for scoring the email message based on results from the determination step; and

means for comparing the score with a predetermined phishing threshold score.