Generating phish messages

• US 8,041,769 B2
• Filed: 11/23/2004
• Issued: 10/18/2011
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Primary Examiner(s): Bates; Kevin
• Assistant Examiner(s): Survillo; Oleg
• Application Number:
  US10/996,568
• Publication Number:
  US 20070294352A1
• Time in Patent Office: 2,520 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. In particular, various embodiments of the invention provide ways to incite unsolicited email messages (such as spam messages, phish messages, etc.). In accordance with some embodiments, a bait email address may be planted in a particular location on the Internet. In particular embodiments, the location of the planted email address may be tracked in order to determine which locations are relatively more likely to generate unsolicited email messages. In other embodiments, domains likely to host the bait email addresses receiving unsolicited messages may be obtained. In some cases, unsolicited messages may be analyzed and/or otherwise processed to determine whether the messages are possibly associated with a fraudulent activity. Such analysis may lead to the investigation of one or more web sites and/or to the initiation of a response against a fraudulent activity.

Claims

1. A method of inciting unsolicited email messages, the method comprising:

planting a bait email address at a location on a computer network, the location being a likely target for a third party attempting to harvest email addresses, wherein the bait email address is a first bait email address;

receiving an email message addressed to the bait email address;

tracking the bait email address, along with the location at which the bait email address was planted;

correlating the received email message with the tracked bait email address and location;

analyzing with a computer system the received email message to determine whether the received email message is an unsolicited email message; and

in response to determining the received email message is an unsolicited message, indicating with the computer system that the location is a likely source for unsolicited email messages, prioritizing the location for additional planting operations, and planting at least one additional bait email address at the location on the Internet at which the first bait email address was planted.

2. A method of inciting unsolicited email messages as recited in claim 1, the method further comprising:

searching a listing of domain registration records for a domain registration record associated with a candidate domain that would be suitable for attracting unsolicited email messages;

monitoring the listing of domain registration records for an expiration of the domain registration record; and

registering the candidate domain.

3. A method of inciting unsolicited email messages as recited in claim 1, further comprising:

generating with the computer system a userid component; and

combining the userid component with a domain name associated with the registered candidate domain to generate the bait email address for planting.

4. A method of inciting unsolicited email messages as recited in claim 1, the method further comprising:

generating the bait email address for planting.

5. A method of inciting unsolicited email messages as recited in claim 4, wherein generating the bait email address for planting comprises:

generating with the computer system a userid component;

selecting with the computer system a domain component; and

combining the userid component and the domain component to generate the bait email address.

6. A method of inciting unsolicited email messages as recited in claim 5, wherein generating a userid component comprises:

selecting a first userid element from a first list;

selecting a second userid element from a second list; and

wherein the userid component comprises the first userid element and the second userid element.

7. A method of inciting unsolicited email messages as recited in claim 1, the method further comprising:

forwarding the received email message to a correlation engine for analysis.

8. A method of inciting unsolicited email messages as recited in claim 1, wherein the received email message includes a uniform resource locator (“

URL”

) configured to direct a recipient of the received email message to a web site referenced by the URL, wherein determining that the received email message is a fraudulent email message comprises;

analyzing the received email message;

based on an analysis of the received email message, categorizing the received email message as a possibly fraudulent email message; and

investigating the URL included with the received email message to determine information about a server hosting the web site referenced by the URL.

9. A method of inciting unsolicited email messages as recited in claim 8, the method further comprising:

preparing a report comprising at least some of the information about the server hosting the web site referenced by the uniform resource locator.

10. A method of inciting unsolicited email messages as recited in claim 9, the method further comprising:

analyzing the report to determine whether the server is likely engaged in a fraudulent activity.

11. A method of inciting unsolicited email messages as recited in claim 10, the method further comprising:

allowing a technician to initiate an action in response to the fraudulent activity.

12. A method of inciting unsolicited email messages as recited in claim 10, the method further comprising:

pursuing an action in response to the fraudulent activity

13. A method of inciting unsolicited email messages as recited in claim 8, wherein analyzing the received email message comprises:

parsing the received email message to identify a header portion of the received email message, a body portion of the received email message, and a uniform resource locator portion of the received email message;

analyzing the header portion of the received email message;

analyzing the body portion of the received email message; and

analyzing the uniform resource locator portion of the received email message.

14. A computer system for inciting unsolicited email messages, the computer system comprising a processor and a computer readable medium having instructions executable by the processor to:

plant at least one bait email address at a location on a computer network, the location being a likely target for a third party attempting to harvest email addresses, wherein the bait email address is a first bait email address;

receive an email message addressed to the bait email address;

track the bait email address, along with the location at which the bait email address was planted;

correlate the received email message with the tracked bait email address and location;

analyze the received email message to determine whether the received email message is an unsolicited email message; and

in response to determining the received email message is an unsolicited message, indicating with the computer system that the planting location is a likely source for unsolicited email messages, prioritizing the planting location for additional planting operations, and planting at least one additional bait email address at the location on the Internet at which the first bait email address was planted.

15. A computer system for inciting unsolicited email messages, as recited in claim 14, the computer readable medium having further instructions executable by the processor to:

search a listing of domain registration records for a domain registration record associated with a candidate domain that would be suitable for attracting unsolicited email messages;

monitor the listing of domain registration records for an expiration of the domain registration record; and

register the candidate domain;

wherein the bait email address comprises a userid component and a domain component, and wherein the domain component is associated with a domain name of the candidate domain.

16. A computer program embodied on a computer readable storage medium, the computer program comprising instructions executable by one or more computers to:

plant at least one bait email address at a location on a computer network, the location being a likely target for a third party attempting to harvest email addresses, wherein the bait email address is a first bait email address;

receive an email message addressed to the bait email address;

track the bait email address, along with the location at which the bait email address was planted;

correlate the received email message with the tracked bait email address and location;

analyze the received email message to determine whether the received email message is an unsolicited email message; and

in response to determining the received email message is an unsolicited message, indicating with the computer system that the planting location is a likely source for unsolicited email messages, prioritizing the planting location for additional planting operations, and planting at least one additional bait email address at the location on the Internet at which the first bait email address was planted.

17. A computer program embodied on a computer readable storage medium, as recited in claim 16, the computer program comprising further instructions executable by one or more computers to:

search a listing of domain registration records for a domain registration record associated with a candidate domain that would be suitable for attracting unsolicited email messages;

monitor the listing of domain registration records for an expiration of the domain registration record; and

register the candidate domain;

wherein the bait email address comprises a userid component and a domain component, and wherein the domain component is associated with a domain name of the candidate domain.

18. A computer-implemented method of inciting unsolicited email messages, the method comprising:

planting a bait email address at a location on the Internet;

correlating the bait email address with the location at which it was planted;

receiving an email message addressed to the bait email address;

tracking the bait email address, along with the location at which the bait email address was planted;

correlating the received email message with the tracked bait email address and location; and

determining, based on the received email message, that the location is likely to generate additional unsolicited email messages;

prioritizing the location for additional planting operations; and

planting at least one additional bail email address at the location based on said prioritizing.

19. A computer-implemented method of inciting unsolicited email messages as recited in claim 18, the method further comprising:

searching a listing of domain registration records for a domain registration record associated with a candidate domain that would be suitable for attracting unsolicited email messages;

monitoring the listing of domain registration records for an expiration of the domain registration record; and

registering the candidate domain;

wherein the bait email address comprises a userid component and a domain component, and wherein the domain component is associated with a domain name of the candidate domain.

20. A computer system for inciting unsolicited email messages, the computer system comprising a processor and a computer readable medium having instructions executable by the processor to:

plant a bait email address at a location on the Internet;

correlate the bait email address with the location at which it was planted;

receive an email message addressed to the bait email address;

track the bait email address, along with the location at which the bait email address was planted;

correlate the received email message with the tracked bait email address and location;

determine, based on the received email message, that the location is likely to generate additional unsolicited email messages;

prioritizing the location for additional planting operations; and

planting at least one additional bait email address at the location based on said prioritizing.

21. A computer program embodied on a computer readable storage medium, the computer program comprising instructions executable by one or more computers to:

plant a bait email address at a location on the Internet;

correlate the bait email address with the location at which it was planted;

receive an email message addressed to the bait email address;

track the bait email address, along with the location at which the bait email address was planted;

correlate the received email message with the tracked bait email address and location;

determine, based on the received email message, that the location is likely to generate additional unsolicited email messages;

prioritizing the location for additional planting operations; and

planting at least one additional bait email address at the location based on said prioritizing.