Patent ID: 7472164

Claim:
A method for identifying spoofed emails, the method comprising the steps of: receiving an email addressed to a recipient in a first network, the email including a plurality of headers, wherein at least one of the plurality of headers includes a sender address; determining whether the sender address indicates a mailbox from within the first network; when the sender address indicates a mailbox from within the first network, modifying at least a portion of the sender address so as to produce a modified sender address that indicates to the recipient that the email is associated with a mailbox that is external to the first network; and sending the email with the modified sender address to the recipient, the modified sender address being visible to the recipient, wherein the step of determining comprises: determining whether the sender address matches any one of a plurality of domains or sub-domains associated with the first network, and the step of modifying comprises: modifying the sender address when the sender address matches any one of the domains or sub-domains associated with the first network.