Phishing solution method

Abstract

A method for preventing phishing attacks is provided. The method in one aspect includes identifying a source image file that was used fraudulently, replacing the content of the source image file with a warning, and allowing the source image file having the warning to be accessed.

1 . A method for deterring fraudulent e-mails, comprising:
 identifying a source image file from a web server directory that was used fraudulently in the fraudulent e-mails by examining the fraudulent e-mails used in a phishing attack;   transferring a source image in the source image file to a new file;   replacing the content of the source image file on the web server directory with a warning; and   allowing the source image file having the warning to be accessed on the web server directory, and   monitoring a number of accesses to the source image file having the warning   wherein the steps of the method are implemented by a computer.   
     
     
         2 . The method of  claim 1 , wherein the source image file used fraudulently is identified as being embedded in a fraudulent e-mail. 
     
     
         3 . The method of  claim 1 , wherein the warning includes graphics image or text or combinations thereof. 
     
     
         4 . The method of  claim 1 , wherein a link to the source image file is embedded in a fraudulent e-mail. 
     
     
         5 . The method of  claim 1 , wherein the source image file is copied from a legitimate Web site source code. 
     
     
         6 . A method of deterring fraudulent e-mails, comprising:
 identifying an enterprise identifying object in a Web page on a web server directory as being a subject of fraudulent use in the fraudulent emails by examining the fraudulent e-mails used in a phishing attack;   replacing the object on the web server directory with a warning object, the warning object having the same name as the object;   installing the warning object on the web server directory to be accessed;   renaming the enterprise identifying object on the web server directory; and   installing the renamed enterprise identifying object on the Web page on the web server directory, and   monitoring a number of accesses to the warning object,   wherein the steps of the method are implemented by a computer.   
     
     
         7 . The method of  claim 6 , wherein the enterprise identifying object is a link to an image of a company logo. 
     
     
         8 . The method of  claim 6 , wherein the enterprise identifying object is a file having an image of a company logo. 
     
     
         9 . A method of deterring fraudulent e-mails, the method comprising:
 identifying an enterprise identifying object in a Web page as being a subject of fraudulent use in the fraudulent emails by examining the fraudulent e-mails used in a phishing attack;   replacing the object with a warning object, the warning object having the same name as the object;   installing the warning object to be accessed;   renaming the enterprise identifying object; and   installing the renamed enterprise identifying object on the Web page, and   monitoring a number of accesses to the warning object,   wherein the method resides on a non-transitory program storage device readable by machine, embodying a program of instructions executable by the machine.   
     
     
         10 . The program storage device of  claim 9 , wherein the enterprise identifying object includes at least a company logo. 
     
     
         11 . The program storage device of  claim 9 , wherein the warning object includes at least a warning message. 
     
     
         12 . The program storage device of  claim 9 , wherein the warning object includes at least a graphics animation providing a warning message. 
     
     
         13 . The method of  claim 1 , further including: determining a referring address of a requestor requesting the new file; and denying the request if the referring address does not match a known address. 
     
     
         14 . The method of  claim 13 , wherein the determining and the denying steps are performed for web pages other than a main home page. 
     
     
         15 . The program storage device of  claim 9 , further including: determining a referring address of a requestor requesting the renamed enterprise identifying object; and denying the request if the referring address does not match a known address. 
     
     
         16 . The program storage device of  claim 15 , wherein the determining and the denying steps are performed for web pages other than a main home page.