Patent ID: 8141150

Claim:
A method for identifying a web site associated with one of a plurality of internet protocol sources used for phishing comprising: determining at a hardware processor whether the web site has received less than a first threshold amount of traffic before a first time; in response to determining that the web site has not received less than a first threshold amount of traffic before a first time, determining that the web site is not categorized as a phishing web site; in response to determining that the web site has received less than a first threshold amount of traffic before a first time, determining at the hardware processor whether the web site has received more than a second threshold amount of traffic between the first time and a second time; in response to determining that the web site has not received more than a second threshold amount of traffic between the first time and a second time, determining that the web site is not categorized as a phishing web site; in response to determining that the web site has received more than a second threshold amount of traffic between the first time and a second time, determining at the hardware processor whether a portion of the more than the second threshold amount of traffic is received by the web site during a third time period after emails are transmitted from one of the plurality of internet protocol sources associated with the web site to a plurality of recipients; in response to determining that the portion of the more than the second threshold amount of traffic is not received by the web site during a third time period after emails are transmitted from the one of the plurality of internet protocol sources associated with the web site to a plurality of recipients, determining the web site is not categorized as a phishing web site; and in response to determining that the portion of the more than the second amount of traffic is received by the web site during the third time period after emails are transmitted from the one of the plurality of internet protocol sources associated with the web site to the plurality of recipients, determining that the portion of the more than the second threshold amount of traffic is temporally related to the emails transmitted to the plurality of recipients.