Patent ID: 8621616

Claim:
A method for identifying suspected phishing websites, comprising: obtaining, using a processor, an address of a website to be identified; determining, according to the address of the website to be identified, that the website to be identified is neither a protected website nor a known phishing website; applying a suspected phishing website rule by matching a regular expression with the address of the website to be identified, wherein the regular expression describes one or more keywords of a website to be protected and variants of the one or more keywords, wherein applying the suspected phishing website rule includes: extracting a uniform resource locator information of a host from the address; determining whether there is at least one interference character in the uniform resource locator information of the host, wherein the at least one interface character comprises a symbol potentially associated with a phishing website; in the event that there is at least one interference character in the uniform resource locator information, modifying the uniform resource locator information by deleting the at least one interference character from the uniform resource locator information of the host and performing a comparison of the regular expression to the modified uniform resource locator information of the host; and in the event that there is no interference character in the uniform resource locator information, performing a comparison of the regular expression to the uniform resource locator information of the host; and in the event that the matching between the address of the website to be identified and the regular expression is successful, determining that the website to be identified is a suspected phishing website.