Online fraud solution
View Patent ↗Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. Some embodiments function to access and/or obtain information from (and/or receive data from) a data source; the data might, for example, indicate a possible instance of online fraud. Certain embodiments, therefore, can be configured to analyze the data, e.g., to determine whether the data indicate a likely instance of online fraud. Such instances may be further investigated, and/or a response may be initiated. Data sources can include, without limitation, web pages, email messages, online chat sessions, domain zone files, newsgroup (and/or posting thereto), etc. Data obtained from the data sources can include, without limitation, suspect domain registrations, uniform resources locators, references to trademarks, advertisements, etc.
1. A method for identifying a phishing scam, the method comprising:
receiving, by a mail server, a plurality of e-mails each comprising a header;
identifying, by the mail server, that at least some of the plurality of e-mails are addressed to a mailbox that does not exist;
routing, by the mail server, a plurality of bounce messages each to an address contained in a RETURN PATH field of the header from the respective at least some of the plurality of e-mails; and
determining that the address contained in the respective headers was not the original sender of the e-mail received by the mail server by analyzing the plurality of bounce messages.
2. The method of claim 1 , wherein the determining that the address contained in the respective headers was not the original sender of the e-mail received by the mail server comprises:
receiving, by the mail server, the plurality of bounce messages, and
determining that the plurality of bounce messages relate to a common mass mailing.
3. The method of claim 2 , wherein the determining that the plurality of bounce messages relate to a common mass mailing includes determining that a body portion of each of the received plurality of e-mails is substantially similar.
4. The method of claim 1 , wherein the plurality of e-mails each comprise a uniform resource locater (URL), the method further comprising:
identifying the URL in each of the plurality of messages;
forwarding the URL to a phish detection system.
5. The method of claim 1 , wherein the plurality of e-mails each comprise a uniform resource locater (URL), the method further comprising:
analyzing the URL in each of the plurality of messages and determine that the URL is associated with a phishing scam.
6. The method of claim 1 , further comprising:
forwarding the plurality of bounce messages to a monitoring appliance.
7. The method of claim 6 , wherein the monitoring appliance identifies a portion of each of the bounce messages and send the identified portion to a phish detection system.
8. The method of claim 7 , wherein the identified portion is a uniform resource locator (URL).
9. The method of claim 8 , wherein the plurality of e-mails have false header information.
10. The method of claim 9 , wherein the false header information comprises at least one of FROM, SENDER, RETURN PATH, and REPLY-TO fields.
11. The method of claim 1 , further comprising:
generating, by the mail server, the plurality of bounce messages in response to identifying that at least some of the plurality of e-mails are addressed to a mailbox that does not exist.
12. A computer system for identifying a phishing scam, the computer system comprising:
a mail server comprising processing circuitry and a memory coupled with the processing circuitry, the memory having stored therein a sequence of instructions which, when executed by the processing circuitry, cause the mail server to:
receive a plurality of e-mails each comprising a header,
identify that at least some of the plurality of e-mails are addressed to a mailbox that does not exist, and
route a plurality of bounce messages each to an address contained in a RETURN PATH field of the header from the respective at least some of the plurality of e-mails; and
a monitoring appliance communicatively coupled to the mail server and configured to determine that the address contained in the respective headers was not the original sender of the e-mail received by the mail server by analyzing the plurality of bounce messages.
13. The computer system of claim 12 , wherein the monitoring appliance is configured to determine that the address contained in the respective headers was not the original sender of the e-mail received by the mail server by determining that the plurality of bounce messages relate to a common mass mailing.
14. The computer system of claim 13 , the monitoring appliance is configured to determine that the plurality of bounce messages relate to a common mass mailing by determining that a body portion of each of the received plurality of e-mails is substantially similar.
15. The computer system of claim 12 , wherein the plurality of e-mails each comprise a uniform resource locater (URL), and wherein the monitoring appliance is configured to identify the URL in each of the plurality of messages and forward the URL to a phish detection system.
16. The computer system of claim 12 , wherein the plurality of e-mails each comprise a uniform resource locater (URL), and wherein the monitoring appliance is configured to analyze the URL in each of the plurality of messages and determine whether the URL is associated with a phishing scam.
17. The computer system of claim 12 , wherein the mail server is configured to forward the plurality of bounce messages to the monitoring appliance.
18. The computer system of claim 17 , wherein the monitoring appliance is configured to identify a portion of each of the bounce messages and send the identified portion to a phish detection system.
19. The computer system of claim 18 , wherein the identified portion is a uniform resource locator (URL).
20. The computer system of claim 12 , wherein the plurality of e-mails have false header information comprising at least one of FROM, SENDER, RETURN PATH, and REPLY-TO fields.