Early detection and monitoring of online fraud

• US 7,870,608 B2
• Filed: 11/23/2004
• Issued: 01/11/2011
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Teslovich; Tamara
• Application Number:
  US10/996,566
• Publication Number:
  US 20060068755A1
• Time in Patent Office: 2,240 Days
• Field of Search: 726/22, 726/26
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04M 15/43 Billing software details
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/22 Bandwidth or usage-sensitve billing

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. In particular, various embodiments of the invention can provide early warning of an online fraud, for instance by finding suspicious domains and/or monitoring those domains for activity. If a suspicious domain shows activity (for example, if a web site associated with the domain becomes active), one or more actions may be taken with respect to the domain.

Claims

1. A method of preventing online fraud, the method comprising:

a computer automatically monitoring a domain registration zone file;

the computer ascertaining a change in a domain registration record incorporated in the domain registration zone file;

the computer monitoring a domain associated with the domain registration record to determine the existence of a web site associated with the domain;

the computer periodically saving on a storage medium a representation of a set of content on the web site associated with the domain to create a plurality of representations of the set of content on the web site;

the computer comparing one of the plurality of the representations of the set of content on the web site with at least one other of the plurality of representations of the set of content on the web site to determine that the set of content has been modified; and

the computer taking an action based on a determination that the set of content on the web site has been modified, wherein taking an action comprises investigating the web site, wherein investigating the web site comprises investigating the domain, and wherein investigating the domain comprises obtaining registration information about the domain from a domain registration record, obtaining current information about an Internet Protocol (“

IP”

) address associated with the web site, and comparing the registration information with the current information.

2. A method of preventing online fraud as recited in claim 1, wherein monitoring the domain registration zone file comprises searching the domain registration zone file for any new or modified domain registrations similar to a brand name of a customer.

3. A method of preventing online fraud as recited in claim 2, the method further comprising verifying that the new or modified domain registrations are not owned by the customer.

4. A method of preventing online fraud as recited in claim 1, wherein the representation of the set of content on the web site is a value calculated from the set of content on the web site.

5. A method of preventing online fraud as recited in claim 4, wherein the value is selected from the group consisting of a hash of at least one web page, a checksum calculated from at least one web page, and a file size of at least one web page.

6. A method of preventing online fraud as recited in claim 1, wherein taking an action comprises informing a user that the domain is active.

7. A method of preventing online fraud as recited in claim 1, wherein taking an action comprises creating an event in an event manager.

8. A method of preventing online fraud as recited in claim 1, wherein investigating the web site comprises interrogating a server associated with the web site.

9. A method of preventing online fraud as recited in claim 1, wherein the information about an IP address associated with the web site is information about an IP block assigned to the domain.

10. A method of preventing online fraud as recited in claim 1, wherein the IP address associated with the web site is an IP address of a server hosting the web site.

11. A method of preventing online fraud as recited in claim 1, wherein taking an action comprises initiating a response against the web site.

12. A method of preventing online fraud as recited in claim 11, wherein initiating a response against the web site comprises submitting to the web site a plurality of substantially simultaneous hypertext transfer protocol (“

HTTP”

) requests.

13. A method of preventing online fraud as recited in claim 12, wherein each of the HTTP requests comprises a response to a request from the server for personal information.

14. A method of preventing online fraud as recited in claim 11, wherein initiating a response against the web site comprises taking an administrative action against the web site.

15. A method of preventing online fraud as recited in claim 14, wherein taking an administrative action comprises informing an ISP associated with the web site that the web site is involved in an online fraud.

16. A method of preventing online fraud as recited in claim 14, wherein taking an administrative action comprises initiating a domain name dispute against an owner of the suspicious domain.

17. A computer system for preventing online fraud, the system comprising a processor, a storage medium and instructions executable by the processor to:

monitor a domain registration zone file;

ascertain a change in a domain registration incorporated in the domain registration zone file;

monitor a domain associated with the domain registration to determine the existence of a web site associated with the domain;

periodically save on the storage medium a representation of a set of content on the web site associated with the domain to create a plurality of representations of the set of content on the web site;

compare one of the plurality of the representations of the set of content on the web site with at least one other of the plurality of representations of the set of content on the web site to determine that the set of content has been modified; and

take an action based on a determination that the set of content on the web site has been modified, wherein taking an action comprises investigating the web site, wherein investigating the web site comprises investigating the domain, and wherein investigating the domain comprises obtaining registration information about the domain from a domain registration record, obtaining current information about an Internet Protocol (“

IP”

) address associated with the web site, and comparing the registration information with the current information.

20. The system of claim 17, wherein monitoring the domain registration zone file comprises searching the domain registration zone file for any new or modified domain registrations similar to a brand name of a customer.

21. The system of claim 20, wherein the instructions are further executable by the processor to:

verify that the new or modified domain registrations are not owned by the customer.

22. The system of claim 17, wherein the representation of the set of content on the web site is a value calculated from the content of the web site, and wherein the value is selected from the group consisting of a hash of at least one web page, a checksum calculated from at least one web page, and a file size of at least one web page.

23. The system of claim 17, wherein investigating the web site comprises interrogating a server associated with the web site.

24. The system of claim 17, wherein the information about an IP address associated with the web site is information about an IP block assigned to the domain.

25. The system of claim 17, wherein the IP address associated with the web site is an IP address of a server hosting the web site.

26. The system of claim 17, wherein taking an action comprises initiating a response against the web site.

27. The system of claim 26, wherein initiating a response against the web site comprises submitting to the web site a plurality of substantially simultaneous hypertext transfer protocol (“

HTTP”

) requests.

28. The system of claim 27, wherein each of the HTTP requests comprises a response to a request from the server for personal information.

29. The system of claim 26, wherein initiating a response against the web site comprises taking an administrative action against the web site.

30. The system of claim 29, wherein taking an administrative action comprises informing an ISP associated with the web site that the web site is involved in an online fraud.

31. The system of claim 29, wherein taking an administrative action comprises initiating a domain name dispute against an owner of the suspicious domain.

32. The system of claim 17, wherein the set of content comprises at least a portion of one or more web pages on the web site.

18. A software program for preventing online fraud, the software program being stored on a non-transitory computer readable medium and comprising instructions executable by a computer to:

monitor a domain registration zone file;

ascertain a change in a domain registration incorporated in the domain registration zone file;

monitor a domain associated with the domain registration to determine the existence of a web site associated with the domain;

periodically save on a storage medium a representation of a set of content on the web site associated with the domain to create a plurality of representations of the set of content on the web site;

compare one of the plurality of the representations of the set of content on the web site with at least one other of the plurality of representations of the set of content on the web site to determine that the set of content has been modified; and

take an action based on a determination that the set of content on the web site has been modified, wherein taking an action comprises investigating the web site, wherein investigating the web site comprises investigating the domain, and wherein investigating the domain comprises obtaining registration information about the domain from a domain registration record, obtaining current information about an Internet Protocol (“

IP”

) address associated with the web site, and comparing the registration information with the current information.

19. A system, comprising:

means for monitoring a domain registration zone file;

means for ascertaining a change in a domain registration incorporated in the domain registration zone file;

means for monitoring a domain associated with the domain registration to determine the existence of a web site associated with the domain;

means for periodically saving a representation of a set of content on the web site associated with the domain to create a plurality of representations of the set of content on the web site;

means for comparing one of the plurality of the representations of the set of content on the web site with at least one other of the plurality of representations of the set of content on the web site to determine that the set of content has been modified; and

means for taking an action based on a determination that the set of content on the web site has been modified, wherein taking an action comprises investigating the web site, wherein investigating the web site comprises investigating the domain, and wherein investigating the domain comprises obtaining registration information about the domain from a domain registration record, obtaining current information about an Internet Protocol (“

IP”

) address associated with the web site, and comparing the registration information with the current information.