Granted Patent B1

US 8,904,168 · App. 14/170,609 · Granted Dec 2, 2014

Abstract

Claims (32)

1. A computer-implemented method, comprising:

receiving a first email;

detecting a first link in the email, wherein the first link is associated with a first link destination;

determining a second link, wherein the second link is associated with a second link destination, wherein the second link destination is associated with a predetermined address and with the first link destination, wherein the predetermined address is associated with a verification site, wherein the verification site enables navigation to the first link destination, subject to verification that the first link destination is not suspicious;

rewriting the first link with the second link;

providing a second email, where the second email differs from the first email at least by having the first link rewritten with the second link;

receiving an HTTP request associated with the verification site, wherein the HTTP request is for the second link destination;

determining the first link destination from the second link destination;

verifying that the first link destination is not suspicious; and

responsive to verifying that the first link destination is not suspicious, enabling navigation to the first link destination.

2. The method of claim 1 , wherein enabling navigation to the first link destination includes providing a redirect to the first link destination.

3. The method of claim 1 , further comprising determining that the first email is suspicious; and wherein rewriting the first link with the second link is responsive to determining that the first email is suspicious.

4. The method of claim 1 , wherein verifying that the first link destination is not suspicious includes at least one of determining that the first link destination is not associated with a blacklist, determining that the first link destination is associated with a whitelist, determining that the first link destination is associated with a previous navigation, determining that the first link is not obfuscated, determining that the first link is not associated with a second destination, wherein the second destination is different than the first link destination, determining that the first link destination is associated with an electronic document, wherein the electronic document is determined not to be suspicious, determining that the first link destination is the same as a third destination, wherein the third destination is associated with a second electronic document and wherein the second electronic document is associated with the first link, and determining that the first link destination is associated with a domain, wherein the domain is not suspicious.

5. The method of claim 1 , wherein determining the first link destination from the second link destination includes extracting an argument from the second link destination.

6. The method of claim 1 , wherein receiving the email is done at an SMTP server.

7. The method of claim 1 , wherein receiving the HTTP request is done at a web server.

8. A computer program product, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:

receiving a first email;

detecting a first link in the email, wherein the first link is associated with a first link destination;

determining a second link, wherein the second link is associated with a second link destination, wherein the second link destination is associated with a predetermined address and with the first link destination, wherein the predetermined address is associated with a verification site, wherein the verification site enables navigation to the first link destination, subject to verification that the first link destination is not suspicious;

rewriting the first link with the second link;

providing a second email, where the second email differs from the first email at least by having the first link rewritten with the second link;

receiving an HTTP request associated with the verification site, wherein the HTTP request is for the second link destination;

determining the first link destination from the second link destination;

verifying that the first link destination is not suspicious; and

responsive to verifying that the first link destination is not suspicious, enabling navigation to the first link destination.

9. The computer program product of claim 8 , wherein enabling navigation to the first link destination includes providing a redirect to the first link destination.

10. The computer program product of claim 8 , further comprising determining that the first email is suspicious; and wherein rewriting the first link with the second link is responsive to determining that the first email is suspicious.

11. The computer program product of claim 8 , wherein verifying that the first link destination is not suspicious includes at least one of determining that the first link destination is not associated with a blacklist, determining that the first link destination is associated with a whitelist, determining that the first link destination is associated with a previous navigation, determining that the first link is not obfuscated, determining that the first link is not associated with a second destination, wherein the second destination is different than the first link destination, determining that the first link destination is associated with an electronic document, wherein the electronic document is determined not to be suspicious, determining that the first link destination is the same as a third destination, wherein the third destination is associated with a second electronic document and wherein the second electronic document is associated with the first link, and determining that the first link destination is associated with a domain, wherein the domain is not suspicious.

12. The computer program product of claim 8 , wherein determining the first link destination from the second link destination includes extracting an argument from the second link destination.

13. The computer program product of claim 8 , wherein receiving the email is done at an SMTP server.

14. The computer program product of claim 8 , wherein receiving the HTTP request is done at a web server.

Assignments (9)