Patent ID: 8528079

Claim:
A method comprising: receiving, by a computer, an email comprising a sender email address and a link; determining, by the computer, a sender domain name from the sender email address; storing, by the computer, a sender login web page associated with the sender domain name, the sender login web page comprising a web page in which a user enters a username and password; ascertaining, by the computer, a Uniform Resource Locator (URL) corresponding to the link of the email; determining, by the computer, a link domain name from the URL; comparing the sender domain name to the link domain name; determining, by the computer, that the sender domain name is different than the link domain name; retrieving, by the computer, a link login web page associated with the link domain name, the link login web page comprising a web page in which a user enters a username and password; determining, by the computer, whether the sender login web page is different than the link login web page; and classifying the URL as a potential phishing URL based on the determining whether the sender login web page is different than the link login web page.