Identifying e-mail security threats

1. A method comprising:

receiving, by one or more processors of a computing device and from one or more social-network servers, social-network data that identifies at least one potentially malicious source accessing a plurality of social-network profiles for a group of users, wherein the social-network data comprises page-view information associated with accessed social-network profiles of the plurality of social-network profiles;

upon determining that a count of the accessed social-network profiles exceeds a threshold level, generating, by the one or more processors and based on the social-network data, a source profile associated with the at least one potentially malicious source;

receiving, by the one or more processors and from one or more e-mail servers, e-mail data associated with a plurality of e-mail messages received by the group of users;

determining, by the one or more processors and based on the e-mail data and the source profile, that an e-mail message of the plurality of e-mail messages is from the at least one potentially malicious source; and

outputting, by the one or more processors, information identifying the e-mail message as being from the potentially malicious source.

2. The method of claim 1 , further comprising

storing the source profile in one or more databases.

3. The method of claim 1 ,

wherein the social-network data comprises profile-content information associated with accessed social-network profiles of the plurality of social-network profiles; and

wherein determining that the e-mail message is from the at least one potentially malicious source comprises comparing information included in the e-mail message with the profile-content information.

4. The method of claim 1 , wherein determining that the e-mail message is from the at least one potentially malicious source comprises:

identifying at least one Internet Protocol (IP) address associated with the at least one potentially malicious source based on the social-network data; and

determining that the e-mail message is sent from the at least one IP address associated with the at least one potentially malicious source.

5. The method of claim 1 , wherein outputting the information identifying the e-mail message as being from the potentially malicious source comprises indicating a type of processing for the e-mail message, wherein the type of processing comprises one of blocking, filtering, highlighting, or labeling the e-mail message.

6. The method of claim 1 , wherein the social-network data comprises relationship information associating a first one of the plurality of social-network profiles with a second one of the plurality of social-network profiles.

7. The method of claim 1 , wherein the plurality of social-network profiles comprise profiles from at least one of:

a company directory; or

a public social-network website.

8. A computing device comprising:

one or more storage unit devices; and

one or more hardware processors in communication with the storage unit devices and configured to:

receive, from one or more social-network sources, social-network data that identifies at least one potentially malicious source accessing a plurality of social-network profiles for a group of users, wherein the social-network data comprises page-view information associated with accessed social-network profiles of the plurality of social-network profiles;

upon determining that a count of the accessed social-network profiles exceeds a threshold level, generate, based on the social-network data, a source profile associated with the at least one potentially malicious source;

receive, from one or more e-mail servers, e-mail data associated with a plurality of e-mail messages received by the group of users;

determine, based on the e-mail data and the source profile, that an e-mail message of the plurality of e-mail messages is from the at least one potentially malicious source; and

output information identifying the e-mail message as being from the potentially malicious source.

9. The computing device of claim 8 , wherein the one or more hardware processors are further configured to

store the source profile in one or more databases.

10. The computing device of claim 8 ,

wherein the social-network data comprises profile-content information associated with accessed social-network profiles of the plurality of social-network profiles; and

wherein the one or more hardware processors are further configured to determine that the e-mail message is from the at least one potentially malicious source by comparing information included in the e-mail message with the profile-content information.

11. The computing device of claim 8 , wherein, to determine that the e-mail message is from the at least one potentially malicious source, the one or more hardware processors are further configured to:

identify at least one Internet Protocol (IP) address associated with the at least one potentially malicious source based on the social-network data; and

determine that the e-mail message is sent from the at least one IP address associated with the at least one potentially malicious source.

12. The computing device of claim 8 , wherein, to output the information identifying the e-mail message as being from the potentially malicious source, the one or more hardware processors are further configured to indicate a type of processing for the e-mail message, wherein the type of processing comprises one of blocking, filtering, highlighting, or labeling the e-mail message.

13. The computing device of claim 8 , wherein the social-network data comprises relationship information associating a first one of the plurality of social-network profiles with a second one of the plurality of social-network profiles.

14. The computing device of claim 8 , wherein the plurality of social-network profiles comprises profiles from at least one of:

a company directory; or

a public social-network website.

15. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed, cause a processor to:

receive, from one or more social-network sources, social-network data that identifies at least one potentially malicious source accessing a plurality of social-network profiles for a group of users, wherein the social-network data comprises page-view information associated with accessed social-network profiles of the plurality of social-network profiles;

upon determining that a count of the accessed social-network profiles exceeds a threshold level, generate, based on the social-network data, a source profile associated with the at least one potentially malicious source;

receive, from one or more e-mail servers, e-mail data associated with a plurality of e-mail messages received by the group of users;

determine, based on the e-mail data and the source profile, that an e-mail message of the plurality of e-mail messages is from the at least one potentially malicious source; and

output information identifying the e-mail message as being from the potentially malicious source.

16. The non-transitory computer-readable storage medium of claim 15 , further having stored thereon instructions that, when executed, cause a processor to

store the source profile in one or more databases.

17. The non-transitory computer-readable storage medium of claim 15 ,

wherein the social-network data comprises profile-content information associated with accessed social-network profiles of the plurality of social-network profiles; and

wherein the non-transitory computer-readable storage medium further has stored thereon instructions that, when executed, cause the processor to determine that the e-mail message is from the at least one potentially malicious source by comparing information included in the e-mail message with the profile-content information.