Patent ID: 9596265
Date: 2017-03-14
CPC Classifications: H04L

Claim:
1. A computer-implemented method, comprising: comparing, by one or more processors, content of a communication to indexed content of a plurality of templates, each template associated with a trustworthy entity and representing indexed content shared among a cluster of communications sent by the trustworthy entity; identifying, by the one or more processors based on the comparing, one or more matched templates; determining, by the one or more processors, that a reply-to address associated with the communication fails to match one or more patterns of reply-to addresses used by one or more trustworthy entities associated with the one or more matched templates; classifying, by the one or more processors based on the determining, the communication as a phishing attempt; and discarding or re-routing, by the one or more processors, the communication in response to the classifying.