Phishing mitigation service
There is disclosed a method of providing passive phishing remediation for an enterprise, including: displaying, to a user of a mobile device, an email; receiving from the user a one-click request to perform additional analysis of the email; providing the email to a phishing mitigation service; assigning the email a reputation score, generating a human-readable reputation display for the email, wherein the human-readable reputation display includes at least three grades comprising safe, unknown or unreliable, and unsafe or malicious; and providing the human-readable reputation display as a push notification to the mobile device.
1. A method of phishing remediation, the method comprising:
receiving, by a phishing mitigation server, an e-mail address for an online e-mail service;
accessing, by the phishing mitigation server, a mailbox, at least in part based on the e-mail address, to receive an email;
downloading, by the phishing mitigation server, a copy of the email without marking the email as read or opened;
requesting, from a uniform resource locator (URL) reputation service, a reputation for a URL associated with the email;
scanning an attachment to the email for phishing or malware features;
analyzing the email for phishing features;
assigning, by the phishing mitigation server, the email an overall phishing score based on the analyzing, the scanning, and the reputation for the URL; and
flagging the email with a warning, at least in part based on the overall phishing score.
2. The method of claim 1 , further comprising
identifying colors, fonts, or logos to identify phishing features.
3. The method of claim 1 , further comprising
identifying use of unsecured hypertext transfer protocol (HTTP) as a phishing indicator.
4. The method of claim 1 , further comprising:
generating a human-readable reputation display for the email, wherein the human-readable reputation display includes at least three grades comprising safe, unknown or unreliable, and unsafe or malicious; and
providing the human-readable reputation display as a push notification.
5. The method of claim 4 , wherein the human-readable reputation display displays safe as green, unknown or unreliable as yellow, and unsafe or malicious as red.
6. The method of claim 4 , further comprising,
upon determining that the overall phishing score is unsafe or malicious, providing with the push notification a textual instruction not to open links on the email.
7. The method of claim 4 , further comprising,
upon determining that the overall phishing score is safe, providing with the push notification a textual instruction that a user can safely interact with the email.
8. The method of claim 1 , further comprising:
deleting the email from the mailbox or moving the email to a spam folder, at least in part based on the overall phishing score.
9. One or more tangible, nontransitory computer-readable storage media having stored thereon executable instructions, the instructions to instruct a processor to:
receive an e-mail address for an online e-mail service;
access a mailbox, at least in part based on the e-mail address, to receive an email;
download a copy of the email without marking the email as read or opened;
request, from a uniform resource locator (URL) reputation service, a reputation for a URL associated with the email;
scan an attachment to the email for phishing or malware features;
analyze the email for phishing features;
assign the email an overall phishing score based on the analyzing, the scanning, and the reputation for the URL; and
flag the email with a warning, at least in part based on the overall phishing score.
10. The one or more tangible, nontransitory computer-readable media of claim 9 , wherein the executable instructions are further to instruct the processor to identify colors, fonts, or logos to identify phishing features.
11. The one or more tangible, nontransitory computer-readable media of claim 9 , wherein the executable instructions are further to instruct the processor to identify use of unsecured hypertext transfer protocol (HTTP) as a phishing indicator.
12. The one or more tangible, nontransitory computer-readable media of claim 9 , wherein the executable instructions are further to instruct the processor to
generate a human-readable reputation display for the email, wherein the human-readable reputation display includes at least three grades comprising safe, unknown or unreliable, and unsafe or malicious; and
provide the human-readable reputation display as a push notification.
13. The one or more tangible, nontransitory computer-readable media of claim 12 , wherein the executable instructions are further to instruct the processor to, upon determining that the overall phishing score is unsafe or malicious, provide with the push notification a textual instruction not to open links on the email.
14. The one or more tangible, nontransitory computer-readable media of claim 12 , wherein the executable instructions are further to instruct the processor to, upon determining that the overall phishing score is safe, provide with the push notification a textual instruction that a user can safely interact with the email.
15. A cloud-based phishing mitigation server, comprising:
a network interface configured to
receive an e-mail address for an online e-mail service;
access a mailbox, at least in part based on the e-mail address, to receive an email;
download a copy of the email without marking the email as read or opened; and
query a uniform resource locator (URL) reputation service, and receive a reputation for a URL associated with the email; and
a processor configured to
scan an attachment to the email for phishing or malware features;
analyze the email for phishing features;
assign the email an overall phishing score based on the analyzing, the scanning, and the reputation for the URL; and
flag the email with a warning, at least in part based on the overall phishing score.
16. The server of claim 15 , wherein the processor is further configured to delete the email from the mailbox or move the email to a spam folder, at least in part based on the overall phishing score.
17. The server of claim 15 , wherein the processor is further configured to keep the email in the mailbox, at least in part based on the overall phishing score.
18. The server of claim 15 , wherein the processor is further configured to identify colors, fonts, or logos to identify phishing features.
19. The server of claim 15 , wherein the processor is further configured to identify use of unsecured hypertext transfer protocol (HTTP) as a phishing indicator.
20. The server of claim 15 , wherein the overall phishing score is at least one of good/safe, unknown/unreliable, or phishing/bad/malicious/unsafe,
the processor is further configured to leave the email alone, if the overall phishing score is good/safe,
the processor is further configured to flag the email with the warning, if the overall phishing score is unknown/unreliable, and
the processor is further configured to delete the email from the mailbox or move the email to a spam folder, if the overall phishing score is phishing/bad/malicious/unsafe.