Patent Document ID: 9985978
Application ID: 14868057

Base Claim:
1. A method for determining whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content, comprising: evaluating text in the email content to determine if predetermined suspected malicious phrases are present in the text; evaluating at least one link in the email content using at least one of an IP address, URL, and a domain name to determine if said at least one link references potentially malicious web content, the evaluating being a two step process of performing an initial analysis based on existing identification information about the at least one link, which includes IP address, URL, and the domain name, before accepting a remaining portion of the email content, which includes message body data; and evaluating metadata in the email content to determine if the email content is potentially malicious; using and configuring a scoring engine for a scoring process by providing a page score for a digital document representing a likelihood that the digital document includes potentially malicious content, the scoring engine uses a Word Expression equation, which includes at least one variable to represent a number of occurrences of at least specific keywords, and patterns in the potentially malicious content in the digital document, the using and configuring the scoring engine includes comparing information extracted from the digital document and forwarding the digital document for analysis and review, and the scoring engine providing at least one of realtime and post-production evaluation of the digital document and provides an output value, including the page score.

---

Claim 6:
6. The method of claim 1 , further comprising: evaluating the email content by a third party entity that monitors email content traffic directly filtered through a sub-system of the third party entity.