Preventing data from being submitted to a remote system in response to a malicious e-mail

1. A computer implemented method for preventing data from being submitted to a remote system responsive to a malicious electronic message, the method comprising the steps of:

examining incoming electronic messages;

determining whether an incoming electronic message comprises at least one suspect link associated with a remote system;

responsive to determining that the incoming message comprises at least one suspect link, replacing each suspect link with a redirection link; and

responsive to a user attempting to connect to the remote system by clicking on the redirection link, directing the request to connect to the remote system to a remote analysis site for deciding whether that incoming message comprises a phishing message.

2. The method of claim 1 wherein the directing step further comprises:

comparing each remote system associated with the suspect link to a list concerning known remote systems.

3. The method of claim 2 wherein the list concerning known remote systems comprises a blacklist comprising addresses of known illegitimate remote systems.

4. The method of claim 3 further comprising the step of:

responsive to each remote system associated with the suspect link not matching a known illegitimate remote system on the blacklist, concluding that the incoming message is not a phishing message.

5. The method of claim 4 further comprising the step of:

responsive to concluding that the message does not comprise a phishing message, allowing user access to the remote system.

6. The method of claim 3 further comprising the step of:

responsive to each remote system associated with the suspect link matching at least one known illegitimate remote system on the blacklist, concluding that the incoming message is a phishing message.

7. The method of claim 6 further comprising the step of:

responsive to concluding that the incoming message is a phishing message, performing at least one step from the group of steps consisting of:

blocking user access to the remote system; and

outputting an alert concerning the remote system.

8. The method of claim 2 wherein the list concerning known remote systems comprises a whitelist containing addresses of known legitimate remote systems.

9. The method of claim 8 further comprising the step of:

responsive to each remote system associated with the suspect link matching a known legitimate remote system on the whitelist, concluding that the incoming message is not a phishing message.

10. The method of claim 9 further comprising the step of:

responsive to concluding that the message does not comprise a phishing message, allowing user access to the remote system.

11. The method of claim 1 wherein the step of examining incoming messages comprises:

scanning an e-mail stream targeted to an e-mail client.

12. The method of claim 1 wherein the step of examining incoming messages comprises:

filtering incoming messages on a server.

13. The method of claim 1 wherein the step of determining whether an incoming electronic message comprises at least one suspect link associated with a remote system comprises:

analyzing each suspect link for known deceptive characteristics.

14. At least one computer-readable medium containing a computer program product for preventing data from being submitted to a remote system responsive to a malicious message, the computer program product comprising:

program code for examining incoming messages;

program code for determining whether an incoming message comprises at least one suspect link associated with a remote system;

program code for replacing the at least one suspect link with a redirection link responsive to determining that the incoming message comprises at least one suspect link; and

program code for directing the request to connect to the remote system to a remote analysis site for deciding whether that incoming message comprises a phishing message responsive to a user attempting to connect to the remote system by clicking on the redirection link.

15. The at least one computer-readable medium of claim 14 wherein the computer program product for the directing step further comprises:

program code for comparing each remote system associated with the suspect link to a list concerning remote systems.

16. The at least one computer-readable medium of claim 15 wherein the computer program product for the list concerning known remote systems comprises program code for a blacklist comprising addresses of known illegitimate remote systems.

17. The at least one computer-readable medium of claim 16 wherein the computer program product further comprises:

program code for concluding that the incoming message is not a phishing message responsive to each remote system associated with the suspect link not matching a known illegitimate remote system on the blacklist.

18. The at least one computer-readable medium of claim 17 wherein the computer program product further comprises:

program code for allowing user access to the remote system responsive to concluding that the message does not comprise a phishing message.

19. The at least one computer-readable medium of claim 16 wherein the computer program product further comprises:

program code for concluding that the incoming message is a phishing message responsive to each remote system associated with the suspect link matching at least one known illegitimate remote system on the blacklist.

20. The at least one computer-readable medium of claim 19 wherein the computer program product further comprises:

program code for performing at least one step from the group of steps

responsive to concluding that the incoming message is a phishing message, the group of steps consisting of:

blocking user access to the remote system; and

outputting an alert concerning the remote system.

21. The at least one computer-readable medium of claim 15 wherein the computer program product for the list concerning known remote systems comprises program code for a whitelist comprising addresses of known legitimate remote systems.

22. The at least one computer-readable medium of claim 21 wherein the computer program product further comprises:

program code for concluding that the incoming message is not a phishing message responsive to each remote system associated with the suspect link matching a known legitimate remote system on the whitelist.

23. The at least one computer-readable medium of claim 22 wherein the computer program product further comprises:

program code for allowing user access to the remote system responsive to concluding that the message does not comprise a phishing message.

24. The at least one computer-readable medium of claim 14 wherein the computer program product for the step of examining incoming messages comprises:

program code for scanning a stream targeted to a client.

25. The at least one computer-readable medium of claim 14 wherein the computer program product for the step of examining incoming messages comprises:

program code for filtering incoming messages on a server.

26. A computer system for preventing data from being submitted to a remote system responsive to a malicious electronic message, the computer system comprising:

a monitor module configured to examine incoming electronic messages, and determine whether an incoming message comprises at least one suspect link associated with a remote system;

a replacement module configured to replace each suspect link with a redirection link responsive to determining that the incoming message comprises at least one suspect link; and

a comparison module configured to direct the request to connect to the remote system to a remote analysis site for deciding whether that incoming message comprises a phishing message responsive to a user attempting to connect to the remote system by clicking on the redirection link.