Method and apparatus for simulating end user responses to spam email messages

• US 8,874,658 B1
• Filed: 05/11/2005
• Issued: 10/28/2014
• Est. Priority Date: 05/11/2005
• Status: Active Grant

• Current Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Khalsa, Gurujiwan, Morss, Dylan
• Primary Examiner(s): Dharia, Rupal
• Assistant Examiner(s): MCKENZIE, MARCUS A
• Application Number:
  US11/127,813
• Time in Patent Office: 3,457 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and system for simulating end user responses to spam email messages are described. In one embodiment, the method includes receiving a probe email message indicative of spam and identifying a seeding component in the probe email message. The method further includes activating the seeding component utilizing a selected email address. The selected email address may then appear to the originator of the probe email message as an active email account.

Claims

1. A method, comprising:

a computer system receiving an email message addressed to a first probe email address;

the computer system determining whether a web beacon is present in the email message;

in response to determining that a web beacon is present in the email message, the computer system identifying the first probe email address in a name string of the web beacon;

the computer system replacing the identified first probe email address in the name string of the web beacon with a second, different probe email address; and

the computer system activating the web beacon, wherein activating the web beacon provides an indication that the second probe email address is active.

2. The method of claim 1, wherein the second probe email address is selected from a plurality of previously utilized probe email addresses.

3. The method of claim 1, wherein the indication is provided to

an originator of the email message.

4. The method of claim 2, wherein the second probe email address is selected based on previous email address use.

5. The method of claim 2, wherein the second probe email address is selected based on email address age.

13. The method of claim 2, wherein the second probe email address is selected based on email address origin.

14. The method of claim 1, wherein activating the web beacon includes using an ISP dialup account to disassociate the indication from IP addresses that are traceable to the computer system.

6. A computer system, comprising:

a processor;

a memory storing program instructions executable to cause the computer system to;

receive an email message addressed to a first probe email address;

determine whether a web beacon is present in the email message;

in response to determining that a web beacon is present in the email message, identify the first probe email address in a name string of the web beacon;

replace the identified first probe email address in the name string of the web beacon with a second, different probe email address; and

activate the web beacon, wherein activating the web beacon provides an indication that the second probe email address is active.

15. The system of claim 6, wherein the indication is provided to an originator of the email message.

16. The computer system of claim 6, wherein the second probe email address is selected from a plurality of previously utilized probe email addresses.

17. The computer system of claim 16, wherein the second probe email address is selected based on previous email address use.

18. The computer system of claim 16, wherein the second probe email address is selected based on email address origin.

19. The computer system of claim 16, wherein the second probe email address is selected based on email address age.

7. A non-transitory computer readable medium comprising instructions executable on a processing system to cause said processing system to:

receive an email message addressed to a first probe email address;

determine whether a web beacon is present in the email message;

in response to determining that a web beacon is present in the email message, identify the first probe email address in a name string of the web beacon;

replace the identified first probe email address in the name string of the web beacon with a second, different probe email address; and

activate the web beacon, wherein activating the web beacon provides an indication that the second probe email address is active.

8. The non-transitory computer readable medium of claim 7, wherein the indication is provided to an originator of the email message.

9. The non-transitory computer readable medium of claim 7, wherein the second probe email address is selected from a plurality of previously utilized probe email addresses.

10. The non-transitory computer readable medium of claim 9, wherein the second probe email address is selected based on previous email address use.

11. The non-transitory computer readable medium of claim 9, wherein the second probe email address is selected based on email address origin.

12. The non-transitory computer readable medium of claim 9, wherein the second probe email address is selected based on email address age.