Phishing scheme detection and termination
View Patent ↗The present invention is a system and method for detecting malicious use of a company email.
1. A method for detecting and halting a malicious use of an email of a company comprising:
providing a company email server implementing a company email service with a plurality of email addresses with a common domain name of the company;
assigning an electronic identification (EID) number to each email sent by the company server to uniquely identify each email to define a unique email;
embedding in each email sent from the email server, a first code when executed sends a request to download a GIF image from a host server having a processor at an absolute source link;
embedding in each of the emails sent, a second code when executed, transmits the EID number of the email from which the GIF request emanated to the host server;
providing the host server for responding to the request to download the GIF image;
counting with the processor the number of requests for download associated with each EID number;
returning the requested GIF image if the number of requests for download or the download rate are not aberrant, wherein the GIF image is displayed in a security zone region of the email as an indicia of authenticity; and,
returning an indicia of a fraudulent email if the number of requests for download or the download rate of the GIF image is aberrant, wherein the indicia is displayed in the security region of the email.
2. The method of claim 1 wherein the email service is HTML email.
3. The method of claim 2 wherein the first code and the second code are part of an HTML image tag associated with the GIF image.
4. The method of claim 1 wherein the indicia of a fraudulent email is an “X” in a box.
5. A system for detecting and halting a malicious use of an email of a company having an email server, a processor and a memory for storing machine readable instructions when executed by the processor take the steps comprising:
providing a company email server implementing a company email service with a plurality of email addresses with a common domain name of the company;
assigning an electronic identification (EID) number to each email sent by the company server to uniquely identify each email to define a unique email;
embedding in each email sent from the email server, a first code when executed sends a request to download a GIF image from a host server having a processor at an absolute source link;
embedding in each of the emails sent, a second code when executed, transmits the EID number of the email from which the GIF request emanated to the host server;
providing the host server for responding to the request to download the GIF image;
counting with the processor the number of requests for download associated with each EID number at the host server;
returning the requested GIF image if the number of requests for download or the download rate are not aberrant, wherein the GIF image is displayed in a security zone region of the email as an indicia of authenticity; and,
returning an indicia of a fraudulent email if the number of requests for download or the download rate of the GIF image is aberrant, wherein the indicia is displayed in the security region of the email.
6. The system of claim 5 wherein the email service is HTML email.
7. The system of claim 5 wherein the first code and the second code are part of an HTML image tag associated with the GIF image.
8. The system of claim 5 wherein the indicia of a fraudulent email is an “X” in a box.
9. A non-transitory machine readable medium for storing machine-readable instructions when executed by a processor take the steps comprising:
providing a company email server implementing a company email service with a plurality of email addresses with a common domain name of the company;
assigning an electronic identification (EID) number to each email sent by the company server to uniquely identify each email to define a unique email;
embedding in each email sent from the email server, a first code when executed sends a request to download a GIF image from a host server having a processor at an absolute source link;
embedding in each of the emails sent, a second code when executed, transmits the EID number of the email from which the GIF request emanated to the host server;
providing the host server for responding to the request to download the GIF image;
counting with the processor the number of requests for download associated with each EID number
returning the requested GIF image if the number of requests for download or the download rate are not aberrant, wherein the GIF image is displayed in a security zone region of the email as an indicia of authenticity; and,
returning an indicia of a fraudulent email if the number of requests for download or the download rate of the GIF image is aberrant, wherein the indicia is displayed in the security region of the email.
10. The non-transitory machine-readable medium of claim 9 wherein the email service is HTML email.
11. The non-transitory machine-readable medium of claim 9 wherein the first code and the second code are part of an HTML image tag associated with the GIF image.
12. The non-transitory machine-readable medium of claim 9 wherein the indicia of a fraudulent email is an “X” in a box.