Method and system for blocking phishing scams

• US 20070136806A1
• Filed: 12/14/2005
• Published: 06/14/2007
• Est. Priority Date: 12/14/2005
• Status: Abandoned Application

• Current Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Original Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Inventors: Berman, Reuben
• Application Number:
  US11/302,274
• Publication Number:
  US 20070136806A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The present invention is directed to a method for blocking phishing, the method comprising the steps of: upon activating a hyperlink within an email message by a user'"'"'s email client: sending the original URL reference of the hyperlink to a phishing inspection utility; testing the original URL reference by the phishing inspection utility for being a phishing URL; if the original URL is not found as phishing URL, directing a browser of the user to the original URL. The method may further comprise the step of: replacing the original URL reference of the hyperlink with a URL reference of the phishing inspection utility; and setting the original URL reference as a parameter to the URL reference of the phishing inspection utility, thereby on activating the hyperlink providing to the inspection utility the URL reference to be tested.

Claims

1. A method for blocking phishing, the method comprising the steps of:

upon activating a hyperlink of an email message at a user'"'"'s email client, testing the URL reference of said hyperlink for being a phishing URL; and

if said URL is not indicated as a phishing URL, directing a browser of said user to said URL.

2. A method according to claim 1, wherein said testing the URL reference of a hyperlink for being a phishing URL is carried out by searching said URL reference in a black list of phishing URL references.

3. A method according to claim 2, wherein said black list is updated by a phishing center over a network.

4. A method for blocking phishing, wherein said sending includes the steps of:

upon activating a hyperlink within an email message by a user'"'"'s email client;

sending an original URL reference of said hyperlink to a phishing inspection utility;

testing said original URL reference by said phishing inspection utility for being a phishing URL;

if said original URL is not found as phishing URL, directing a browser of said user to said original URL.

5. A method according to claim 4, wherein said sending includes the steps of:

replacing the original URL reference of said hyperlink with a URL reference of said phishing inspection utility; and

setting said original URL reference as a parameter to said URL reference of said phishing inspection utility, thereby on activating said hyperlink providing to said inspection utility the URL reference to be tested.

6. A method according to claim 4, wherein said testing is carried out by searching said original URL reference within a black list of known phishing URL references.

7. A method according to claim 4, wherein said phishing inspection utility is located remotely to said email client.

8. A method for blocking phishing, the method comprising the steps of:

at a point in a path of an email message from a sender thereof to a recipient thereof;

replacing an original URL reference of a hyperlink within said email message with a URL reference of a phishing inspection utility, and setting said original URL reference as a parameter of said URL reference of said phishing inspection utility;

upon activating said hyperlink from an email client;

sending the original URL reference of said hyperlink to said phishing inspection utility;

testing said original URL reference by said phishing inspection utility as being a phishing URL;

if said original URL is not found as phishing URL, directing a browser of said user to said original URL.

9. A method according to claim 8, wherein said testing is carried out by searching said original URL reference within a black list of known phishing URL references.

10. A method according to claim 8, wherein said phishing inspection utility is located remotely to said email client.

11. A system for blocking phishing of an email message to be displayed by an email client, comprising:

a phishing inspection utility;

a utility for sending a URL reference of an activated hyperlink of an email message to said phishing inspection utility instead of directing a browser to said URL;

a utility for activating a browser to access said URL if said testing indicates that said URL is not a phishing URL.

12. A system according to claim 11, wherein said utility for testing a URL as being a phishing URL determines said URL as phishing URL if said URL exists within a black list of phishing URL references.

13. A system according to claim 11, further comprising a center for updating said black list of phishing URL references.