Patent Document ID: 10021133
Application ID: 14942983
Patent Flag: 1

Claim One:
1. A method for detecting a phishing site, comprising: intercepting, by a security gateway, a message from a client to a site; determining, by the security gateway, if the site is a known-site or an unknown-site; checking, by the security gateway, reputation of the site, and if the site is a known-site with a good reputation, performing, by the security gateway, known-site testing for possible phishing attack, wherein, the known-site testing includes: identifying a page of the site being accessed; determining if a reputation for the page of the site being accessed is known or unknown; and if the reputation for the page of the site being accessed is unknown, performing an unknown page testing for possible phishing attack, wherein, the unknown page testing including: generating a page risk score for the page; comparing the page risk score with a threshold value; and if the page risk score is greater than the threshold value, performing additional risk assessment, wherein, the additional risk assessment including: determining claims made on the page; determining claims made on the site; comparing claims made on the page with claims made on the site for a match; and if there is a match, forwarding the message from the client to the site.