Anti-phishing protection

Abstract

Anti-Phishing protection assists in protecting against phishing attacks. Any links that are contained within a message that has been identified as a phishing message are disabled. A warning message is shown when the phishing message is accessed. The first time a disabled link within the phishing message is selected a dismissible dialog box is displayed containing information about how to enable links in the message. After the user dismisses the dialog, clicking on a disabled link causes the warning message to flash drawing the user's attention to the potential severity of the problem. The links may be enabled by the user by selecting the warning message and choosing the appropriate option. Once the user enables the links, future displays of the message show the links as enabled.

1 - 20 . (canceled) 
     
     
         21 . A system, comprising:
 at least one processor; and   memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:
 processing a message that includes a link to an external source; 
 determining that the message includes a potential phishing attack; 
 based on the determination:
 marking the message as a phishing message; 
 disabling the link; and 
 storing the message in a message folder in accordance with the determination. 
 
   
     
     
         22 . The system of  claim 21 , wherein processing the message comprises passing the message through a phishing filter. 
     
     
         23 . The system of  claim 22 , wherein the phishing filter determines whether the message was sent by an entity considered to be safe. 
     
     
         24 . The system of  claim 23 , wherein, when the message is determined to be sent by an entity considered to be safe, marking the message as a safe message. 
     
     
         25 . The system of  claim 24 , wherein, when the message is marked as a safe message, the message folder is an inbox. 
     
     
         26 . The system of  claim 21 , wherein determining that the message includes a potential phishing attack comprises examining formatting of one or more URLs within the message. 
     
     
         27 . The system of  claim 21 , wherein marking the message as a phishing message comprises assigning a suspicion level to the message. 
     
     
         28 . The system of  claim 21 , wherein the message is an email message, and wherein the message folder is a junk mail folder. 
     
     
         29 . The system of  claim 21 , wherein marking the message comprises adding an indicator indicating the message is a phishing message, and storing the indicator in the message. 
     
     
         30 . A method comprising:
 processing a message that includes a link to an external source;   determining that the message includes a potential phishing attack;   based on the determination:
 marking the message as a phishing message; 
 disabling the link; and 
 storing the message in a message folder in accordance with the determination. 
   
     
     
         31 . The method of  claim 30 , wherein determining that the message includes a potential phishing attack comprises examining formatting of one or more URLs within the message. 
     
     
         32 . The method of  claim 30 , wherein marking the message as a phishing message comprises assigning a suspicion level to the message. 
     
     
         33 . The method of  claim 30 , wherein the message is an email message, and wherein the message folder is a spam folder. 
     
     
         34 . A system, comprising:
 at least one processor; and   memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:
 accessing a message determined to include a potential phishing attack, wherein the message includes a disabled link to an external source, and an indication marking the message as a phishing message; and 
 in response to accessing the message, displaying the message including the disabled link and a visible warning indicating that the message includes the potential phishing attack. 
   
     
     
         35 . The system of  claim 34 , wherein accessing the message comprises identifying the message in a junk mail. 
     
     
         36 . The system of  claim 34 , wherein accessing the message comprises identifying the message was sent by an entity considered to be safe and identifying the message in an inbox. 
     
     
         37 . The system of  claim 34 , wherein the message comprises two or more links and every link in the message is disabled. 
     
     
         38 . The system of  claim 34 , wherein the method further comprises:
 receiving a selection of the disabled link;   displaying a dialog indicating the disabled link is potentially unsafe; and   receiving a dismissal of the dialog.   
     
     
         39 . The system of  claim 38 , wherein receiving a dismissal of the dialog causes the disabled link to be enabled. 
     
     
         40 . The system of  claim 39 , wherein enabling the disabled link causes the message to be marked with a property, wherein the property indicates future accesses of the message will display links enabled within the message.