Patent ID: 8595830

Claim:
A computing system implemented process for detecting malware containing e-mails based on inconsistencies between a governmental agency “From” address and a sending IP address comprising: receiving an e-mail; using one or more processors associated with one or more computing systems to analyze the “From” heading of the e-mail to identify a “From” address associated with a government agency; using one or more processors associated with one or more computing systems to determine that the “From” heading of the e-mail includes a “From” address associated with a government agency; using one or more processors associated with one or more computing systems to determine the country associated with the government agency of the “From” address associated with a government agency in the “From” heading of the e-mail; using one or more processors associated with one or more computing systems to identify one or more sending IP addresses associated with the e-mail; using one or more processors associated with one or more computing systems to analyze the one or more sending IP addresses associated with the e-mail to determine geographical locations associated with the sending IP addresses associated with the e-mail; using one or more processors associated with one or more computing systems to compare data indicating the country associated with the government agency of the “From” address associated with the government agency in the “From” heading of the e-mail and data indicating the geographical locations associated with the sending IP addresses associated with the e-mail; using one or more processors associated with one or more computing systems to identify an inconsistency between the data indicating the country associated with the government agency of the “From” address associated with a government agency in the “From” heading of the e-mail and data indicating at least one of the geographical locations associated with the sending IP addresses associated with the e-mail; using one or more processors associated with one or more computing systems to transform data indicating a status of the e-mail to a status of potential malware containing e-mail; and using one or more processors associated with one or more computing systems to take protective action associated with the e-mail.