Patent ID: 7475425
Filing Date: 2009-01-06
Classification: H04L

Abstract:
1. A system for automatic detection of masquerading websites, wherein an Internet Domain Name Service (DNS) server returns an address of the masquerading website to a requester device due to a prior DNS server attack whereby one or more Internet Domain Name Service (DNS) table entries that map Universal Resource Locators (URLs) to Internet Protocol addresses have been changed, said system comprising: an authentication server for performing a test on a target website's IP address and behavior, said testing performed by said authentication server including: first testing a both a domain name and an Internet address of a requested web-site against a list of domain name and Internet address pairs maintained by the authentication server to determine whether the pair is valid; and, second testing a status of a requested site as maintained by the authentication server, said second testing conducted on the domain name of the requested site wherein said authentication server maintains a status list including a list of domain names, each with an associated status, said second testing to ensure the authentication server itself maintains a correct mapping of domain name and Internet address; and a plurality of workstations, each said plurality of workstations including a program for alerting an Internet user of said masquerading web sites based upon said test, wherein said program compares said behavior of said target website's IP address and behavior with a criterion for acceptability, said criterion for acceptability verifying that the response capacity of said target website is greater than a threshold value.