US 12,452,303 B2
Phishing email campaign identification
Javier Castro, Kensington, MD (US)
Assigned to CLOUDFLARE, INC., San Francisco, CA (US)
Filed by CLOUDFLARE, INC, San Francisco, CA (US)
Filed on Feb. 5, 2024, as Appl. No. 18/433,090.
Application 18/433,090 is a continuation of application No. 17/574,443, filed on Jan. 12, 2022, granted, now 11,895,151.
Prior Publication US 2024/0179180 A1, May 30, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 51/212 (2022.01); H04L 9/06 (2006.01); H04L 9/08 (2006.01); H04L 9/32 (2006.01)
CPC H04L 63/1483 (2013.01) [H04L 51/212 (2022.05); H04L 63/12 (2013.01); H04L 63/123 (2013.01); H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 9/0643 (2013.01); H04L 9/0894 (2013.01); H04L 9/3239 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method executed by one or more email detection computers, the method comprising:
receiving, from a digital electronic computer network, a first email message that is directed to a first recipient account from a first sender account, the first email message being associated with a plurality of attributes;
determining that the first email message is a phishing email;
extracting, from the first email message, a subset of the plurality of attributes, the subset of the plurality of attributes comprising a plurality of fixed attributes and a plurality of transformable attributes;
transforming each particular transformable attribute of the plurality of transformable attributes to a normalized representation of that particular transformable attribute;
generating a hash representation of the subset of the plurality of attributes based on the plurality of fixed attributes and the normalized representations of the plurality of transformable attributes;
storing the hash representation of the subset of the plurality of attributes of the first email message in a database;
receiving, from the digital electronic computer network, a second email message that is directed to a second recipient account from a second sender account;
determining that the second email message is a phishing email based on the hash representation corresponding to the first email message.