Patent Document ID: 8701185
Application ID: 12287802

Base Claim:
1. A method for locating a previously undetected phishing Web site, comprising: selecting a legitimate Web site; selecting an indexed public search engine that previously has crawled the Web, has identified mirror Web sites, and has created an indexed database of Web sites containing data already collected and indexed and excluding mirror Web sites that it uses to respond to search queries; examining the indexed database of the selected public search engine for the presence of an unauthorized phishing Web site of the selected legitimate Web site, the unauthorized phishing Web site having differences from the legitimate Web site that prevent it from being identified as a mirror of the legitimate Web site by the public search engine, by: selecting an element that is present in the selected legitimate Web site and that relates to a characteristic identifying feature of the legitimate Web site; forming a search query using the selected element; submitting the search query to the indexed database of the selected public search engine; and receiving from the selected search engine a search report of Web sites in the search engine indexed database identified in response to the search query using the selected search element; and eliminating the preselected legitimate Web site from the Web sites identified in the search report; comparing an additional element that is present in the Web sites identified in the search report that remain after eliminating the preselected legitimate Web site with a corresponding element present in the selected legitimate Web site; using the comparison of the additional element to detect a difference from the selected legitimate Web site that is present in a Web site that remains after eliminating the preselected legitimate Web site to identify the Web site that remains as an unauthorized phishing Web site of the preselected legitimate Web site; and communicating the identity of the detected unauthorized phishing Web site of the selected legitimate Web site for further action.

---

Claim 9:
9. The method claimed in claim 1 wherein the selected element is a characteristic feature of the selected legitimate Web site that is at least one of the name of a Web site owner, a charity associated with the selected legitimate Web site, or text used in the selected legitimate Web site.