Method and system for tracking fraudulent activity

Patent metadata

Field	Value
Publication number	US-9386029-B2
Application number	US-201414244418-A
Country	US
Kind code	B2
Filing date	Apr 3, 2014
Priority date	Aug 20, 2004
Publication date	Jul 5, 2016
Grant date	Jul 5, 2016

Abstract

A method and system for tracking potentially fraudulent activities associated with one or more web sites is disclosed. The system includes a fraud tracking server connected to a fraud tracking database. The fraud tracking server includes a communications module to facilitate the exchange of data between the server and multiple client devices. The fraud tracking server receives data from one or more client devices that identifies a potential spoof site. The fraud tracking server also includes control logic to generate a spoof site tracking record in the fraud tracking database. The spoof site tracking record includes the data identifying the potential spoof site. After the spoof site tracking record has been created, the fraud tracking server notifies an administrator of the potential spoof site by communicating the data received and stored in the fraud tracking database to an administrator.

First claim

What is claimed is:

1. A system for tracking potentially fraudulent activity, the system including:
a fraud tracking database; and
a fraud tracking server connected to the fraud tracking database, the fraud tracking server including:
a memory having instructions embodied thereon;
one or more processors coupled to the memory and configured by the instructions to perform operations comprising:
receiving data identifying a spoof site;
generating a spoof site tracking record stored in the fraud tracking database, the spoof site tracking record including the data identifying the spoof site;
retrieving a first document from the spoof site;
storing contents of the first document in the spoof site tracking record;
automatically monitoring the spoof site to determine whether the spoof site is still active by periodically attempting to access the document associated with the spoof site;
comparing contents of a document retrieved during the automatic monitoring with the stored contents of the first document; and
based on a result of the comparison, updating the spoof site tracking record by adding to the spoof site tracking record data indicating whether or not the first document was still accessible during the automatic monitoring.

2. The system of claim 1 , wherein the data identifying the spoof site is a URL identifying a document associated with the spoof site, and the one or more processors are further configured to extract the URL from an email.

3. The system of claim 2 , wherein the operations further comprise automatically communicating the URL extracted from the email to an administrator.

4. The system of claim 3 , wherein the operations further comprise:
receiving verification from the administrator that the spoof site is an actual spoof site; and
automatically updating the spoof site tracking record with data associated with the actual spoof site.

5. The system of claim 4 , wherein the verification received from the administrator indicates that the administrator has viewed the spoof site and determined that the spoof site is an actual spoof site.

6. The system of claim 4 , wherein the operations further comprise automatically retrieving data associated with the actual spoof site based on the administrative module receiving the verification from the administrator that the spoof site is the actual spoof site.

7. The system of claim 4 , wherein the one or more processors are further configured to:
analyze an IP address of a server hosting the spoof site to determine an ISP associated with the IP address; and
automatically generate an email addressed to the ISP associated with the IP address, the email notifying the ISP of the spoof site and requesting the ISP to take action to remove the spoof site.

8. The system of claim 2 , wherein the operations further comprise analyzing the URL identifying the document to determine whether the URL is associated with a previously identified spoof site for which a spoof site tracking record already exists.

9. The system of claim 1 , wherein the operations further comprise:
updating the spoof site tracking with data indicating a time of the last attempt to access the first document.

10. The system of claim 1 , wherein the analysis of the contents of the document comprises an analysis of source code of the document.

11. The system of claim 1 , wherein the operations further comprise:
responsive to a determination that the first document was not still accessible during the automatic monitoring, notifying an administrator that the first document needs to be reviewed.

12. A method comprising:
receiving data identifying a spoof site;
generating, by a processor of a machine, a spoof site tracking record stored in a fraud tracking database, the spoof site tracking record including the data identifying the spoof site;
retrieving a first document from the spoof site;
storing contents of the first document in the spoof site tracking record;
automatically monitoring, by the processor of the machine, the spoof site to determine whether the spoof site is still active by periodically attempting to access the document associated with the spoof site;
comparing contents of a document retrieved during the automatic monitoring with the stored contents of the first document; and
based on a result of the comparison, updating the spoof site tracking record by adding to the spoof site tracking record data indicating whether or not the first document was still accessible during the automatic monitoring of the actual spoof site.

13. The method of claim 12 , further comprising:
responsive to receiving verification that the spoof site is an actual spoof site, retrieving data associated with the actual spoof site; and,
updating the spoof site tracking record with the retrieved data associated with the actual spoof site.

14. The method of claim 13 , wherein the verification is received from an administrator who has viewed the spoof site and identified the spoof site as an actual spoof site.

15. The method of claim 13 , wherein retrieving data associated with the actual spoof site occurs automatically based on verification being received that the spoof site is an actual spoof site.

16. The method of claim 13 , further comprising:
analyzing the IP address of the server hosting the spoof site to determine an ISP associated with the IP address; and
generating an email addressed to the ISP associated with the IP address, the email notifying the ISP of the spoof site and requesting the ISP to take action to remove the spoof site.

17. The method of claim 16 , wherein analyzing the IP address of the server hosting the spoof site and generating an email addressed to the ISP associated with the IP address occur automatically in response to receiving verification that the spoof site is an actual spoof site.

18. A non-transitory machine-readable medium storing a set of instructions that, when executed by the machine, cause the machine to perform operations comprising:
receiving data identifying a spoof site;
generating a spoof site tracking record in a fraud tracking database, the spoof site tracking record including the data identifying the spoof site;
retrieving a first document from the spoof site;
storing contents of the first document in the spoof site tracking record;
automatically monitoring the actual spoof site to determine whether the spoof site is still active by periodically attempting to access the document associated with the spoof site;
comparing contents of a document retrieved during the automatic monitoring with the stored contents of the first document; and
based on a result of the comparison, updating the spoof site tracking record by adding to the spoof site tracking record data indicating whether or not the first document was still accessible during the automatic monitoring.

19. The non-transitory machine-readable medium of claim 18 , wherein:
the data identifying a potential spoof site is a URL identifying a document associated with the spoof site;
the receiving of the data receives the data in an email; and
the operations further comprise extracting the URL from the email.

20. The non-transitory machine-readable medium of claim 19 , wherein the operations further comprise automatically communicating the URL extracted from the email to an administrator.

Assignees

• Paypal Inc

Inventors

• Pham Quang D
• Henley Mathew Gene
• Brown Andrew Millard
• Edberg Jeremy B

Classifications

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title