Systems and methods to detect and notify victims of phishing activities
Systems and methods to detect the identities of victims of phishing activities, in which embedding, in an item, an element having a reference to a server, is embedded in an item (e.g., a webpage or a mobile application) that may be copied by attackers. When used on a user computer, the element generates a request to the server. Based on the request, the server identifies a user of the element embedded in the item or a copy of the item. Based on uses of the element, the server tracks a history of the user using the item or the copy of the item. In response to a determination that the element is currently being used by the user in the item and the history indicates that the user has used the copy of the item, the server identifies the user as a victim of the copy of the item.
1. A method to detect phishing activities and victims, the method comprising:
embedding, in an item, an element having a reference to a server, wherein when used on a user computer, the element generates a request to the server;
receiving, in the server, the request;
identifying, by the server and based on the request, a user of the element embedded in the item or a copy of the item;
tracking, in the server and based on uses of the element, a history of the user using one or more copies the item containing the element; and
in response to a determination that the element is currently being used by the user in the item and the history indicates that the user has used the copy of the item, identifying the user as a victim of the copy of the item,
wherein the tracking of the history of the user using the one or more copies the item containing the element is based on matching a fingerprint of the user computer,
wherein the fingerprint is based on attributes of least one of software of the user computer and hardware of the user computer, and
wherein the attributes include at least one of: an internet protocol (IP) address of the user computer; a geolocation of the IP address; a browser identifier of the user computer; a language of the user computer; an identifier of a platform of the user computer; and an identifier of an operating system of the user computer.
2. The method of claim 1 , further comprising: in response to the request, providing by the server a resource as a response.
3. The method of claim 2 , wherein the item is a webpage; and the element is one of: a script; a style sheet; a browser plugin; an image; a mobile application; an applet; and a request for a servlet.
4. The method of claim 3 , wherein the request identifies a host that provides the item or a copy of the item, in which the element is used in the user computer.
5. The method of claim 4 , further comprising: storing a whitelist of one or more legitimate hosts of the item; and identifying the user as a victim in response to a determination that a host of the copy is not on the whitelist.
6. The method of claim 3 , wherein the tracking of the history of the user using the one or more copies the item containing the element is based on a browser cookie provided by the server.
7. The method of claim 1 , wherein the request includes identification information provided by the user to a hosting item of the element that is being used in the user computer.
8. The method of claim 7 , wherein when used on the user computer, the element inspects content of a data field containing login credential of the user to generate the identification information.
9. The method of claim 7 , wherein the request further includes an identification of a destination of the data being submitted via the hosting item used on in the user computer.
10. The method of claim 7 , wherein the request further includes a fingerprint of the hosting item of the element that is being used in the user computer.
11. The method of claim 10 , wherein the hosting item is a mobile application.
12. A non-transitory computers storage medium storing instructions configured to instruct a computing device to perform a method to detect phishing activities and victims, the method comprising:
receiving, in a server, a request generated by a user computer using an element, wherein the element is embedded in an item and has a reference to the server;
identifying, by the server and based on the request, a user of the element embedded in the item or a copy of the item;
tracking, in the server and based on uses of the element, a history of the user using one or more copies the item containing the element; and
in response to a determination that the element is currently being used by the user in the item and the history indicates that the user has used the copy of the item, identifying the user as a victim of the copy of the item,
wherein the tracking of the history of the user using the one or more copies the item containing the element is based on matching a fingerprint of the user computer,
wherein the fingerprint is based on attributes of least one of software of the user computer and hardware of the user computer, and
wherein the attributes include at least one of: an internet protocol (IP) address of the user computer; a geolocation of the IP address; a browser identifier of the user computer; a language of the user computer; an identifier of a platform of the user computer; and an identifier of an operating system of the user computer.
13. A computing device, comprising:
at least one microprocessor; and
memory storing instructions configured to instruct the computing device to perform a method to detect phishing activities and victims, by:
receiving, in a server, a request generated by a user computer using an element, wherein the element is embedded in an item and has a reference to the server;
identifying, by the server and based on the request, a user of the element embedded in the item or a copy of the item;
tracking, in the server and based on uses of the element, a history of the user using one or more copies the item containing the element; and
in response to a determination that the element is currently being used by the user in the item and the history indicates that the user has used the copy of the item, identifying the user as a victim of the copy of the item,
wherein the tracking of the history of the user using the one or more copies the item containing the element is based on matching a fingerprint of the user computer,
wherein the fingerprint is based on attributes of least one of software of the user computer and hardware of the user computer, and
wherein the attributes include at least one of: an internet protocol (IP) address of the user computer; a geolocation of the IP address; a browser identifier of the user computer; a language of the user computer; an identifier of a platform of the user computer; and an identifier of an operating system of the user computer.
14. The computing device of claim 13 , wherein the element contains computer instructions executable on the user computer to inspect data content provided in a data field in a hosting item of the element and determine an identity of the user based on the data content.
15. The computing device of claim 14 , wherein when executed on the user computer the computer instructions identify a destination to which the data content is submitted via the hosting item of the element.
16. The computing device of claim 14 , wherein when executed on the user computer the computer instructions provide the identity of the user and information about the hosting item of the element to the server.
17. The computing device of claim 13 , wherein the hosting item is one of: a webpage and a mobile application.