Early detection and monitoring of online fraud

• US 20060068755A1
• Filed: 11/23/2004
• Published: 03/30/2006
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Granted Patent: US 7,870,608 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04M 15/43 Billing software details
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/0148 Fraud detection or prevention means
• CPC Class Codes: H04M 2215/22 Bandwidth or usage-sensitve billing

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. In particular, various embodiments of the invention can provide early warning of an online fraud, for instance by finding suspicious domains and/or monitoring those domains for activity. If a suspicious domain shows activity (for example, if a web site associated with the domain becomes active), one or more actions may be taken with respect to the domain.

Claims

1. In a relationship between a fraud protection provider and a customer, a system for combating online fraud, the system comprising:

a monitoring center for monitoring a suspicious email activity, the monitoring center comprising;

a first computer, the first computer comprising a first processor and instructions executable by the first processor to allow an analysis of an investigation of a uniform resource locator;

a first telecommunication link configured to provide communication between a technician and the customer, such that the technician can notify the customer of a result of the investigation of a uniform resource locator and the customer can provide instructions for responding to a fraudulent attempt to collect personal information; and

a second telecommunication link configured to provide data communication between the monitoring center and at least one additional computer; and

a second computer in communication with the monitoring center via the second telecommunication link, the second computer comprising a second processor and instructions executable by the second processor to;

access a data source comprising data about a plurality of domain name registrations;

acquire from the data source the data about a new domain name registration;

evaluate the data to determine whether a suspicious domain name has been registered; and

monitor a domain associated with the suspicious domain name for activity.

2. A system for combating online fraud as recited in claim 1, wherein the second computer includes further instructions executable to:

monitor the suspicious domain for activity.

3. A system for combating online fraud as recited in claim 2, wherein monitoring the suspicious domain for activity comprises monitoring the suspicious domain to determine the existence of a web site associated with the domain.

4. A system for combating online fraud as recited in claim 2, wherein monitoring the suspicious domain for activity comprises periodically saving a representation of a web site associated with the suspicious domain to create a plurality of representations of the web site.

5. A system for combating online fraud as recited in claim 4, wherein monitoring the suspicious domain for activity further comprises comparing one of the plurality of the representations with at least one other of the plurality of representations.

6. A system for combating online fraud as recited in claim 5, wherein the second computer includes instructions further executable by the second computer to:

take an action if the comparison reveals that the web site has been modified.

7. A method of preventing online fraud, the method comprising:

finding a new or modified domain registration in a domain registration zone file, wherein the new or modified domain registration is similar to a customer'"'"'s brand name;

determining that the new or modified domain registration is not owned by the customer;

a computer periodically monitoring a domain associated with the domain registration to determine whether the domain has become active; and

taking an action if domain becomes active.

8. A method of preventing online fraud as recited in claim 7, wherein monitoring the domain comprises:

determining the existence of a web site associated with the domain.

9. A method of preventing online fraud as recited in claim 8, wherein monitoring the domain further comprises:

monitoring the web site for changes.

10. A method of preventing online fraud as recited in claim 9, wherein monitoring the web site for changes comprises:

periodically saving, on a storage medium, a representation of the web site to create a plurality of representations of the web site; and

comparing one of the plurality of the representations with at least one other of the plurality of representations.

11. A method of preventing online fraud, the method comprising:

a computer automatically monitoring a domain registration zone file;

the computer ascertaining a change in a domain registration record incorporated in the domain registration zone file;

the computer monitoring a domain associated with the domain registration record to determine the existence of a web site associated with the domain;

periodically saving on a storage medium a representation of the web site associated with the domain to create a plurality of representations of the web site;

comparing one of the plurality of the representations with at least one other of the plurality of representations; and

taking an action if the comparison reveals that the web site has been modified.

12. A method of preventing online fraud as recited in claim 11, wherein monitoring the domain registration zone file comprises searching the domain registration zone file for any new or modified domain registrations similar to a brand name of a customer.

13. A method of preventing online fraud as recited in claim 12, the method further comprising verifying that the new or modified domain registrations are not owned by the customer.

14. A method of preventing online fraud as recited in claim 11, wherein the representation of the web site is a value calculated from the content of the web site.

15. A method of preventing online fraud as recited in claim 14, wherein the value is selected from the group consisting of a hash of at least one web page, a checksum calculated from at least one web page, and a file size of at least one web page.

16. A method of preventing online fraud as recited in claim 11, wherein taking an action comprises informing a user that the domain is active.

17. A method of preventing online fraud as recited in claim 11, wherein taking an action comprises creating an event in an event manager.

18. A method of preventing online fraud as recited in claim 11, wherein taking an action comprises investigating the web site.

19. A method of preventing online fraud as recited in claim 18, wherein investigating the web site comprises interrogating a server associated with the web site.

20. A method of preventing online fraud as recited in claim 18, wherein investigating the web site comprises investigating the domain.

21. A method of preventing online fraud as recited in claim 20, wherein investigating the domain comprises:

obtaining (a) information about the domain;

obtaining (b) information about an Internet Protocol (“

IP”

) address associated with the web site; and

comparing (a) with (b).

22. A method of preventing online fraud as recited in claim 21, wherein the information about an IP address associated with the web site is information about an IP block assigned to the domain.

23. A method of preventing online fraud as recited in claim 21, wherein the IP address associated with the web site is an IP address of a server hosting the web site.

24. A method of preventing online fraud as recited in claim 11, wherein taking an action comprises initiating a response against the web site.

25. A method of preventing online fraud as recited in claim 24, wherein initiating a response against the web site comprises submitting to the web site a plurality of substantially simultaneous hypertext transfer protocol (“

HTTP”

) requests.

26. A method of preventing online fraud as recited in claim 25, wherein each of the HTTP requests comprises a response to a request from the server for personal information.

27. A method of preventing online fraud as recited in claim 24, wherein initiating a response against the web site comprises taking an administrative action against the web site.

28. A method of preventing online fraud as recited in claim 27, wherein taking an administrative action comprises informing an ISP associated with the web site that the web site is involved in an online fraud.

29. A method of preventing online fraud as recited in claim 27, wherein taking an administrative action comprises initiating a domain name dispute against an owner of the suspicious domain.

30. A computer system for preventing online fraud, the computer system comprising a processor and instructions executable by the processor to:

find a new or modified domain registration in a domain registration zone file, wherein the new or modified domain registration is similar to a customer'"'"'s brand name;

determine that the new or modified domain registration is not owned by the customer;

periodically monitor a domain associated with the domain registration to determine whether the domain has become active; and

take an action if domain becomes active.

31. A computer system for preventing online fraud, the system comprising a processor, a storage medium and instructions executable by the processor to:

monitor a domain registration zone file;

ascertain a change in a domain registration incorporated in the domain registration zone file;

monitor a domain associated with the domain registration to determine the existence of a web site associated with the domain;

periodically save on the storage medium a representation of the web site associated with the domain to create a plurality of representations of the web site;

compare one of the plurality of the representations with at least one other of the plurality of representations; and

take an action if the comparison reveals that the web site has been modified.

32. A software program for preventing online fraud, the software program being embodied on a computer readable medium and comprising instructions executable by a computer to:

find a new or modified domain registration in a domain registration zone file, wherein the new or modified domain registration is similar to a customer'"'"'s brand name;

determine that the new or modified domain registration is not owned by the customer;

periodically monitor a domain associated with the domain registration to determine whether the domain has become active; and

take an action if domain becomes active.

33. A software program for preventing online fraud, the software program being embodied on a computer readable medium and comprising instructions executable by a computer to:

monitor a domain registration zone file;

ascertain a change in a domain registration incorporated in the domain registration zone file;

monitor a domain associated with the domain registration to determine the existence of a web site associated with the domain;

periodically save on the storage medium a representation of the web site associated with the domain to create a plurality of representations of the web site;

compare one of the plurality of the representations with at least one other of the plurality of representations; and

take an action if the comparison reveals that the web site has been modified.

34. A system, comprising:

means for finding a new or modified domain registration in a domain registration zone file, wherein the new or modified domain registration is similar to a customer'"'"'s brand name;

means for determining that the new or modified domain registration is not owned by the customer;

means for periodically monitoring a domain associated with the domain registration to determine whether the domain has become active; and

means for taking an action if domain becomes active.

35. A system, comprising:

means for monitoring a domain registration zone file;

means for ascertaining a change in a domain registration incorporated in the domain registration zone file;

means for monitoring a domain associated with the domain registration to determine the existence of a web site associated with the domain;

means for periodically saving a representation of the web site associated with the domain to create a plurality of representations of the web site;

means for comparing one of the plurality of the representations with at least one other of the plurality of representations; and

means for taking an action if the comparison reveals that the web site has been modified.