Patent ID: 8131742

Claim:
A method, comprising: receiving, by a computing device, an electronic message, the electronic message including a first address of a suspicious network site; parsing, by the computing device, the electronic message to determine the first address of the suspicious network site; determining, by the computing device, whether the first address matches one or more previously stored addresses in a database; in response to determining that the first address does not match the one or more previously stored addresses in the database, displaying, by the computing device, a first user interface prompting a user to classify the suspicious network site in accordance with one or more classification criteria; continuously monitoring, by the computing device, the suspicious network site over a predefined period of time; based on the monitoring, determining, by the computing device, whether a status of the suspicious network site has changed during the predefined period of time; in response to determining that the status of the suspicious network site has changed, determining, by the computing device, whether one or more attributes of the suspicious network site matches the one or more classification criteria; in response to determining that the one or more attributes of the suspicious network site matches the one or more classification criteria, determining, by the computing device, whether the one or more classification criteria are indicative of a legitimate site; displaying, by the computing device, a second user interface that includes one or more controls enabling the user to identify one or more entities responsible for the suspicious network site; and displaying, by the computing device, a third user interface that includes an email template enabling the user to create, based on the email template, at least one cease and desist letter to be sent to the one or more entities responsible for the suspicious network site.