System and method for combating phishing
In one embodiment, the present invention relates to a method and system for combating phishing. A computer receives an email comprising a sender email address and a link. The computer determines a sender domain name from the sender email address and ascertains a Uniform Resource Locator (URL) corresponding to the link. The computer then determines a link domain name from the URL. The computer then determines whether the sender domain name is different than the link domain name, so as to classify the URL as a potential phishing URL.
1. A method comprising:
receiving, by a computer, an email comprising a sender email address and a link;
determining, by the computer, a sender domain name from the sender email address;
storing, by the computer, a sender login web page associated with the sender domain name, the sender login web page comprising a web page in which a user enters a username and password;
ascertaining, by the computer, a Uniform Resource Locator (URL) corresponding to the link of the email;
determining, by the computer, a link domain name from the URL;
comparing the sender domain name to the link domain name;
determining, by the computer, that the sender domain name is different than the link domain name;
retrieving, by the computer, a link login web page associated with the link domain name, the link login web page comprising a web page in which a user enters a username and password;
determining, by the computer, whether the sender login web page is different than the link login web page; and
classifying the URL as a potential phishing URL based on the determining whether the sender login web page is different than the link login web page.
2. The method of claim 1 , further comprising determining that the sender domain name is found in a stored list of domain names.
3. The method of claim 2 , further comprising determining that the link domain name is found in the stored list of domain names.
4. The method of claim 1 , wherein the receiving an email comprising a sender email address and a link further comprises receiving an email comprising a sender email address, a link, and a recipient email address.
5. The method of claim 4 , further comprising:
determining that the sender domain name is not found in a stored list of domain names;
determining that the sender email address is not found in an address book associated with the recipient email address; and
determining that the link domain name does not match the sender domain name and is not found in the stored list of domain names.
6. The method of claim 4 , further comprising transmitting the email to the recipient email address.
7. The method of claim 6 , further comprising indicating to a computer displaying the email that the link in the email has a potential phishing URL.
8. The method of claim 7 , further comprising transmitting a confirmation web page to the computer when a user associated with the recipient email address clicks on the link in the email.
9. The method of claim 8 , wherein the transmitting a confirmation web page further comprises transmitting a confirmation web page displaying differences between the sender login web page and the link login web page.
10. The method of claim 8 , wherein the transmitting a confirmation web page further comprises transmitting a confirmation web page displaying differences between the sender domain name and the link domain name.