Enhanced responses to online fraud

• US 20070294762A1
• Filed: 11/23/2004
• Published: 12/20/2007
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Granted Patent: US 7,992,204 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. In particular, various embodiments of the invention provide enhanced responses to an identified instance of online fraud. Such enhanced responses can incorporate one or more of a variety of strategies for defeating an attempt by a server to filter and/or otherwise avoid responses to its fraudulent activity. Merely by way of example, responses may be disguised (e.g., by transmitting the responses from a variety of computers, by transmitting responses that appear to originate from a computer different than the actual source of the responses, etc.). In some cases, a response strategy may be implemented that forces the server (and/or an operator thereof) to choose between accepting the responses and blocking potential responses from the targets of the fraudulent scheme. In these and other ways, embodiments of the invention can provide robust solutions to fraudulent activity, thereby diminishing the effectiveness of the fraudulent activity.

Claims

1. A method of combating online fraud, the method comprising:

determining that a web server is engaged in a fraudulent activity;

generating a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

transmitting each of the plurality of HTTP requests for reception by the web server, wherein each of plurality of HTTP requests appears to originate from a one of a plurality of Internet Protocol (“

IP”

) blocks.

2. A method of combating online fraud as recited in claim 1, wherein determining that a web server is engaged in a fraudulent activity comprises interrogating the server to determine whether the server is engaged in a fraudulent activity.

3. A method of combating online fraud as recited in claim 1, wherein each of the HTTP requests comprises a response to a request from the server for personal information.

4. A method of combating online fraud as recited in claim 3, wherein the request from the server comprises an HTML form.

5. A method of combating online fraud as recited in claim 3, wherein each of the HTTP requests comprises a set of safe data associated with a fictitious identity, and wherein each set of safe data appears to comprise a valid response to the online form.

6. A method of combating online fraud as recited in claim 5, wherein at least one of the sets of safe data is associated with an account at a financial institution.

7. A method of combating online fraud as recited in claim 1, wherein the plurality of HTTP requests is sufficient to substantially prevent the server from responding to an HTTP request submitted by a third party.

8. A method of combating online fraud as recited in claim 1, wherein the plurality of HTTP requests are not sufficient to impair any functions of the server other than the server'"'"'s ability to respond to HTTP requests.

9. A method of combating online fraud as recited in claim 1, wherein the plurality of substantially simultaneous HTTP requests are not sufficient to impair a network infrastructure providing communication with the server.

10. A method of combating online fraud as recited in claim 1, further comprising:

implementing at least one countermeasure to defeat an attempt to filter the HTTP requests.

11. A method of combating online fraud as recited in claim 1, wherein at least one of the plurality of IP blocks is owned by a retail Internet service provider.

12. A method of combating online fraud as recited in claim 1, wherein the plurality of HTTP requests is sufficient to impede an attempt by the web server to block the plurality of HTTP requests.

13. A method of combating online fraud as recited in claim 1, wherein the plurality of IP blocks is sufficiently diverse impede an attempt by the web server to block the plurality of HTTP requests.

14. A method of combating online fraud as recited in claim 1, wherein the plurality of IP blocks are selected so that an attempt by the web site to block the plurality of HTTP requests results in blocking a significant number of consumers from submitting HTTP requests to the web site.

15. A method of combating online fraud as recited in claim 1, wherein the each of the plurality of HTTP requests is transmitted via a megaproxy, and wherein the megaproxy is configured to transmit the plurality of HTTP requests in such a way as to make each of plurality of HTTP requests appear to originate from a one of a plurality of IP blocks.

16. A method of combating online fraud as recited in claim 1, wherein the each of the plurality of HTTP requests is transmitted via a proxy chain, and wherein the proxy chain is configured to transmit the plurality of HTTP requests in such a way as to obscure the source of the plurality of HTTP requests.

17. A method of combating online fraud, the method comprising:

providing a dilution engine;

providing a megaproxy in communication with the dilution engine, the megaproxy being configured to receive and retransmit a plurality of hypertext transfer protocol (“

HTTP”

) requests;

determining that a web server is engaged in a fraudulent activity;

generating with the dilution engine a plurality of HTTP requests;

transmitting the plurality of HTTP requests for reception by the megaproxy;

receiving at the megaproxy the plurality of HTTP requests; and

retransmitting the plurality of HTTP requests from the megaproxy for reception by the web server;

wherein

the plurality of HTTP requests are retransmitted from the megaproxy in such a way as to obscure the dilution engine as the source of the HTTP requests.

18. A method of combating online fraud as recited in claim 17, wherein the megaproxy is configured to transmit the HTTP requests in such a way that each of the plurality of HTTP requests appears to originate from a different block of Internet Protocol (IP) numbers.

19. A method of combating online fraud as recited in claim 17, wherein the megaproxy is configured to transmit the HTTP requests in such a way that at least one of the plurality of HTTP requests appears to originate from a retail Internet service provider.

20. A method of combating online fraud as recited in claim 17, wherein the megaproxy is incorporated within a meet-me center.

21. A method of combating online fraud, the method comprising:

obtaining a plurality of blocks of Internet Protocol (“

IP”

) addresses, wherein each of the plurality of blocks of IP addresses comprises at least one IP address;

providing a megaproxy configured to transmit a plurality of hypertext transfer protocol (“

HTTP”

) requests;

identifying an illegitimate web site;

generating an HTTP request;

obtaining an IP address from one of the plurality of blocks of IP addresses; and

transmitting the HTTP request from the megaproxy for reception by the illegitimate web site, wherein the megaproxy is configured to transmit the HTTP request in such a way that the HTTP request appears to originate from the obtained IP address.

22. A method of combating online fraud as recited in claim 21, the method further comprising:

storing a record of the plurality of blocks of IP addresses;

23. A method of combating online fraud as recited in claim 22, wherein obtaining an IP address comprises:

consulting the record of the plurality of blocks of IP addresses to determine and available IP address; and

obtaining the available IP address.

24. A method of combating online fraud as recited in claim 23, the method further comprising updating the record of the plurality of blocks of IP addresses to indicate that the obtained IP address is unavailable, at least for a certain period of time, for use in transmitting an HTTP request for reception by the identified illegitimate web site.

25. A method of combating online fraud as recited in claim 21, wherein the plurality of blocks of IP addresses comprises a first block of IP addresses associated with a first Internet service provider.

26. A method of combating online fraud as recited in claim 25, wherein the IP address is obtained from the first block of IP addresses, and wherein the HTTP request appears to originate from a customer of the first retail Internet service provider.

27. A method of combating online fraud as recited in claim 26, wherein the plurality of blocks of IP addresses further comprises a second block of IP addresses associated with a second retail Internet service provider, and wherein the method further comprises:

generating a second HTTP request;

obtaining a second IP address from the second block of IP addresses;

and transmitting the second HTTP request from the megaproxy for reception by the illegitimate web site, wherein the megaproxy is configured to transmit the second HTTP request in such a way that the second HTTP request appears to originate from a customer of the second retail Internet service provider.

28. A method of combating online fraud, the method comprising:

providing a plurality of proxy servers, each of the plurality of proxy servers being configured to receive and retransmit hypertext transfer protocol (“

HTTP”

) requests;

identifying an illegitimate web site;

generating an HTTP request with a dilution engine;

transmitting the HTTP request from the dilution engine to a first of the plurality of proxy servers;

receiving the HTTP request at the first of the plurality of proxy servers;

retransmitting the HTTP request from the first of the plurality of proxy servers to a second of the plurality of proxy servers; and

receiving the HTTP request at the second of the plurality of proxy servers; and

retransmitting the HTTP request from the second of the plurality of proxy servers for reception by the legitimate web site, such that the illegitimate web site is unable to identify the dilution engine as the source of the HTTP request.

29. A method of combating online fraud as recited in claim 28, wherein at least one of the first and second proxy servers is configured to modify header information in the HTTP request to make the HTTP request appear to originate from a source different from the dilution engine.

30. A method of combating online fraud as recited in claim 29, wherein the at least one of the first and second proxy servers is configured to modify header information in the HTTP request to make the HTTP request appear to originate from a customer of a retail Internet service provider.

31. A method of combating online fraud as recited in claim 28, the method further comprising:

generating a second HTTP request with the dilution engine;

transmitting the second HTTP request from the dilution engine to a third of the plurality of proxy servers;

receiving the second HTTP request at the third of the plurality of proxy servers;

retransmitting the second HTTP request from the third of the plurality of proxy servers to a fourth of the plurality of proxy servers; and

receiving the second HTTP request at the fourth of the plurality of proxy servers; and

retransmitting the second HTTP request from the fourth of the plurality of proxy servers for reception by the legitimate web site, such that the web site is unable to identify the dilution engine as the source of the second HTTP request.

32. A method of combating online fraud as recited in claim 28, wherein at least one of the first and second proxy servers is operated by a retail Internet service provider.

33. A method of combating online fraud as recited in claim 31, the method further comprising:

selecting the first, second, third and fourth proxy servers to minimize the ability of the illegitimate web site to identify the dilution engine as the source of the HTTP requests.

34. A method of combating online fraud, the method comprising:

providing a facility for providing a plurality of telecommunication lines in communication with a plurality of Internet service providers, the plurality of telecommunication lines comprising a first telecommunication line in communication with a first Internet service provider and a second telecommunication line in communication with a second Internet service provider, wherein the first Internet service provider comprises a first proxy server and wherein the second Internet service provider comprises a second proxy server;

identifying an illegitimate web site;

generating a plurality of hypertext transfer protocol (“

HTTP”

) requests, the plurality of HTTP requests comprising a first HTTP request and a second HTTP request;

transmitting the first HTTP request via the first telecommunication line, the first HTTP request to be retransmitted by the first proxy server for reception by the illegitimate web site, such that the first HTTP request appears to originate from a customer of the first Internet service provider; and

transmitting the second HTTP request via the second telecommunication line, the second HTTP request to be retransmitted by the second proxy server for reception by the illegitimate web site, such that the second HTTP request appears to originate from a customer of the second Internet service provider.

35. A method of combating online fraud as recited in claim 34, wherein at least one of the first and second Internet service providers is a retail Internet service provider.

36. A method of combating online fraud as recited in claim 34, wherein the facility for providing communication with a plurality of Internet service providers comprises a modem pool.

37. A method of combating online fraud as recited in claim 36, wherein the facility for providing communication with a plurality of Internet service providers further comprises a private branch exchange.

38. A method of combating online fraud as recited in claim 34, wherein the facility for providing communication with a plurality of Internet service providers comprises a peering connection with each of the plurality of Internet service providers.

39. A system for combating online fraud, the system comprising:

a dilution engine configured to generate a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

a computer configured to transmit each of the plurality of HTTP requests to a web server, wherein each of plurality of HTTP requests appears to originate from a one of a plurality of IP blocks.

40. A system for combating online fraud as recited in claim 39, wherein the computer comprises a mega-proxy.

41. A system for combating online fraud as recited in claim 39, wherein the computer is incorporated within a network meet-me center.

42. A computer system for combating online fraud, the system comprising a processor and a computer readable medium having instructions executable by the processor to:

determine that a web server is engaged in a fraudulent activity;

generate a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

transmit each of the plurality of HTTP requests for reception by the web server, wherein each of plurality of HTTP requests appears to originate from a one of a plurality of Internet Protocol (“

IP”

) blocks.

43. A system for combating online fraud, the system comprising:

an investigation system configured to determine that a web server is engaged in a fraudulent activity;

a dilution engine in communication with the investigation system, the dilution engine being configured to;

generate a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

transmit the plurality of HTTP requests for reception by a megaproxy;

a megaproxy in communication with the dilution engine, the megaproxy being configured to

receive the plurality of HTTP requests; and

retransmit the plurality of HTTP requests for reception by the web server in such a way as to obscure the dilution engine as the source of the HTTP requests.

44. A system for combating online fraud as recited in claim 43, wherein the investigation system comprises a computer comprising a processor and a computer readable medium having instructions executable by the processor to identify an illegitimate web site, the illegitimate web site being hosted by the server engaged in the fraudulent activity.

45. A system for combating online fraud as recited in claim 43, wherein the dilution engine is incorporated within the investigation system.

46. A system for combating online fraud as recited in claim 43, wherein the dilution engine is incorporated within the megaproxy.

47. A system for combating online fraud as recited in claim 43, wherein the dilution engine and the megaproxy are incorporated within a network meet-me center.

48. A system for combating online fraud, the system comprising:

a computer comprising a processor and a computer readable medium having instructions executable by the processor to;

obtain a plurality of block of Internet protocol (“

IP”

) addresses, wherein the plurality of blocks of IP addresses comprises a first block of IP addresses associated with a first Internet service provider, and wherein each of the plurality of blocks of IP addresses comprises at least one IP address;

identify an illegitimate web site;

generate a hypertext transfer protocol (“

HTTP”

) request; and

transmit the HTTP request for reception by a megaproxy; and

a megaproxy configured to;

receive the HTTP request;

obtain an IP address from one of the plurality of blocks of IP addresses; and

transmit the HTTP request for reception by the illegitimate web site in such a way that the HTTP request appears to originate from the obtained IP address.

49. A system for combating online fraud as recited in claim 48, wherein the computer further comprises a data store in communication with the processor, and wherein the computer readable medium has further instructions executable by the processor to store a record of the plurality of blocks of IP addresses in the data store.

50. A system for combating online fraud, the system comprising:

a plurality of proxy servers, each of the plurality of proxy servers being configured to receive and retransmit hypertext transfer protocol (“

HTTP”

) requests, wherein the plurality of proxy servers comprises a first proxy server and a second proxy server;

an investigation system configured to identify an illegitimate web site;

a dilution engine configured to;

generate an HTTP request; and

transmit the HTTP request to the first proxy server;

wherein the first proxy server is configured to;

receive the HTTP request; and

retransmit the HTTP request the second proxy server; and

wherein the second proxy server is configured to;

receive the HTTP request; and

retransmit the HTTP request for reception by the illegitimate web site, such that the web site is unable to identify the dilution engine as the source of the HTTP request.

51. A system for combating online fraud, the system comprising:

a facility for providing a plurality of telecommunication lines in communication with a plurality of Internet service providers, the plurality of telecommunication lines comprising a first telecommunication line in communication with a first Internet service provider and a second telecommunication line in communication with a second Internet service provider, wherein the first Internet service provider comprises a first proxy server and wherein the second Internet service provider comprises a second proxy server;

an investigation system configured to identify an illegitimate web site; and

a dilution engine configured to;

generate a plurality of hypertext transfer protocol (“

HTTP”

) requests, the plurality of HTTP requests comprising a first HTTP request and a second HTTP request;

transmit the first HTTP request via the first telecommunication line, the first HTTP request to be retransmitted by the first proxy server for reception by the illegitimate web site, such that the first HTTP request appears to originate from a customer of the first Internet service provider; and

transmit the second HTTP request via the second telecommunication line, the second HTTP request to be retransmitted by the second proxy server for reception by the illegitimate web site, such that the second HTTP request appears to originate from a customer of the second Internet service provider.

52. A computer program embodied on a computer readable medium, the software program comprising instructions executable by a computer to:

generate a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

transmit each of the plurality of HTTP requests to a web server, wherein each of plurality of HTTP requests appears to originate from a one of a plurality of Internet Protocol (“

IP”

) blocks.

53. A software program as recited in claim 52, the computer program comprising further instructions executable by a computer to:

determine that a web server is engaged in a fraudulent activity;

54. A computer program embodied on at least one computer readable medium, the computer program comprising:

a first module comprising instructions executable by a computer to;

determine that a web server is engaged in a fraudulent activity;

a second module comprising instructions executable by a computer to;

generate a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

transmit the plurality of HTTP requests for reception by a megaproxy; and

a third module comprising instructions executable by a megaproxy to;

receive the plurality of HTTP requests; and

retransmit the plurality of HTTP requests for reception by the web server in such a way as to obscure a computer executing the first module as the source of the HTTP requests.

55. A computer program as recited in claim 54, wherein the first module, the second module and the third module are configured to be executed on a first computer, and wherein the first computer comprises the megaproxy.

56. A computer program as recited in claim 54, wherein the first module is configured to be executed on a first computer, wherein the second module and third modules are configured to be executed on a second computer, and wherein the second computer comprises the megaproxy.

57. A computer program embodied on a computer readable medium, the computer program comprising instructions executable by one or more computers to:

obtain a plurality of block of Internet protocol (“

IP”

) addresses, wherein the plurality of blocks of IP addresses comprises a first block of IP addresses associated with a first Internet service provider, and wherein each of the plurality of blocks of IP addresses comprises at least one IP address;

identify an illegitimate web site;

generate a hypertext transfer protocol (“

HTTP”

) request;

transmit the HTTP request for reception by a megaproxy;

receive the HTTP request at the megaproxy;

obtain an IP address from one of the plurality of blocks of IP addresses; and

transmit the HTTP request for reception by the illegitimate web site in such a way that the HTTP request appears to originate from the obtained IP address.

58. A computer program embodied on a computer readable medium, the computer program comprising instructions executable by one or more computers to:

identify an illegitimate web site;

generate an HTTP request; and

transmit the HTTP request from the dilution to a first proxy server;

instruct the first proxy server to retransmit the HTTP request to a second proxy server to enable the second proxy server to retransmit the HTTP request for reception by the illegitimate web site, such that the web site is unable to identify the dilution engine as the source of the HTTP request.

59. A computer program embodied on a computer readable medium, the computer program comprising instructions executable by one or more computers to:

interface with a facility for providing a plurality of telecommunication lines in communication with a plurality of Internet service providers, the plurality of telecommunication lines comprising a first telecommunication line in communication with a first Internet service provider and a second telecommunication line in communication with a second Internet service provider, wherein the first Internet service provider comprises a first proxy server and wherein the second Internet service provider comprises a second proxy server;

identify an illegitimate web site; and

generate a plurality of hypertext transfer protocol (“

HTTP”

) requests, the plurality of HTTP requests comprising a first HTTP request and a second HTTP request;

transmit the first HTTP request via the first telecommunication line, the first HTTP request to be retransmitted by the first proxy server for reception by the illegitimate web site, such that the first HTTP request appears to originate from a customer of the first Internet service provider; and

transmit the second HTTP request via the second telecommunication line, the second HTTP request to be retransmitted by the second proxy server for reception by the illegitimate web site, such that the second HTTP request appears to originate from a customer of the second Internet service provider.

60. A system for combating online fraud, the system comprising:

means for determining that a web server is engaged in a fraudulent activity;

means for generating a plurality of hypertext transfer protocol (“

HTTP”

) requests; and

means for transmitting each of the plurality of HTTP requests to the web server, wherein each of plurality of HTTP requests appears to originate from a one of a plurality of Internet Protocol (“

IP”

) blocks.

61. A system for combating online fraud, the system comprising:

means for determining that a web server is engaged in a fraudulent activity;

means for generating a plurality of HTTP requests;

means for transmitting the plurality of HTTP requests for reception by a megaproxy;

means for receiving at the megaproxy the plurality of HTTP requests; and

means for retransmitting the plurality of HTTP requests for reception by the web server;

wherein

the plurality of HTTP requests are retransmitted in such a way as to obscure the means for generating a plurality of HTTP requests as the source of the HTTP requests.

62. A system for combating online fraud, the system comprising:

means for obtaining a plurality of block of Internet protocol (“

IP”

) addresses, wherein the plurality of blocks of IP addresses comprises a first block of IP addresses associated with a first Internet service provider, and wherein each of the plurality of blocks of IP addresses comprises at least one IP address;

means for storing a record of the plurality of blocks of IP;

megaproxy means configured to transmit a plurality of hypertext transfer protocol (“

HTTP”

) requests;

means for identifying an illegitimate web site;

means for generating an HTTP request; and

means for obtaining an IP address from one of the plurality of blocks of IP addresses;

wherein the megaproxy means is configured to transmit the HTTP request for reception by the illegitimate web site, wherein the megaproxy is configured to transmit the HTTP request in such a way that the HTTP request appears to originate from the obtained IP address.

63. A system for combating online fraud, the system comprising:

a plurality of proxy means for receiving and retransmitting hypertext transfer protocol (“

HTTP”

) requests, the plurality of proxy means comprising a first proxy means and a second proxy means;

means for identifying an illegitimate web site;

means for generating an HTTP request with a dilution engine;

means for transmitting the HTTP request from the dilution to a first of the plurality of proxy means;

wherein;

the first proxy means is configured to receive the HTTP request from and retransmit the HTTP a second of the plurality of proxy means; and

the second proxy means is configured to receive the HTTP request and retransmit the HTTP request reception by the legitimate web site, such that the web site is unable to identify the dilution engine as the source of the HTTP request.

64. A system for combating online fraud, the system comprising:

first telecommunication means for providing communication with a first Internet service provider, the first Internet service provider comprising a first proxy server;

second telecommunication means in communication with a second Internet service provider, the second Internet service provider comprising a second proxy server;

means for identifying an illegitimate web site;

means for generating a plurality of hypertext transfer protocol (“

HTTP”

) requests, the plurality of HTTP requests comprising a first HTTP request and a second HTTP request;

means for transmitting the first HTTP request via the first telecommunication means, the first HTTP request to be retransmitted by the first proxy server for reception by the illegitimate web site, such that the first HTTP request appears to originate from a customer of the first Internet service provider; and

means for transmitting the second HTTP request via the second telecommunication means, the second HTTP request to be retransmitted by the second proxy server for reception by the illegitimate web site, such that the second HTTP request appears to originate from a customer of the second Internet service provider.