Patent ID: 8381292

Claim:
A method for facilitating the identification of a phishing website targeting a specific brand, comprising the steps of: a. receiving a url suspected of being a phishing website; b. retrieving the index page associated with said url; c. determining whether the retrieved index page has been processed before and whether it is associated with a particular brand of interest and logging the results; d. when the index page has not been processed before, conducting the following steps: i. retrieving all elements referenced in said index page at said suspect url; ii. calculating a hash value for each of said retrieved elements to create a hash value set associated with said url; iii. comparing said hash value set to prior saved hash value sets and calculating a similarity value for each said comparison; iv. comparing said hash value set to prior saved hash value sets and determining whether said hash value set is associated with any particular brand of interest; v. when said suspect url is associated with a particular brand of interest, adjusting a comparison threshold responsive to pre-established parameters associated with said brand; vi. for each suspect url associated with a particular brand of interest, determining when if the calculated similarity value exceeds the adjusted threshold; and, vii. returning a no match indication when none of said similarity values exceeds said threshold; e. when a no match indication is returned, sending an electronic communication to a human indicting further evaluation of said url is necessary, f. maintaining a numerical quantity indicator to track brand encounters in said identification process and adjusting said threshold indicator responsive to pre-established quantity indicator values.