Using web search engines to correct domain names used for social engineering

#Phishing is a substantial security threat in the field of information security. Phishing may include attempts to acquire sensitive information, such as, personal details, usernames, passwords and/or credit card details, mostly for malicious purposes, by masquerading as a trustworthy entity in an electronic communication environment, such as, a website on the internet. Phishing may entice users to provide sensitive information by luring unsuspecting users to visit fraudulent websites that appear to be legitimate websites.

#Phishing attempts may use various different mechanisms to lure unsuspecting users to visit fraudulent websites, such as, a fraudulent site link included in an email message or an instant message, a fraudulent site link embedded in digital media, and/or a fraudulent site name retrieved in response to a search query associated with a public search engine.

#Any version of phishing also may rely, at least in part, on the concept of social engineering, which generally may refer to the psychological manipulation of people into performing a particular action and/or divulging confidential information. Some social engineering techniques may rely on various conditions of human nature to convince a user to perform a particular action and/or divulge confidential information, such as preying on a person's need for human interaction, appealing to a person's sense of vanity and/or greed, and/or the like. The social engineering techniques may also include presenting the fraudulent website to the user in a manner that visually mimics a known legitimate website, but that includes relatively minor syntactic, semantic, and/or visual alterations to the legitimate website. In this manner, when the unsuspecting user selects the fraudulent link and visits the fraudulent website, the user may likely not be aware that he is visiting the fraudulent website instead of the legitimate website.

#Some examples of the disclosure are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of examples of the disclosure. In this regard, the description taken with the drawings makes apparent to those skilled in the art how examples of the disclosure may be practiced.

#In the drawings:

#FIG. 1 is a flowchart of an exemplary process for detecting hyperlinks associated with untrusted web resources and replacing them with trusted hyperlinks associated with trusted web resources based on an analysis of search engine(s) results at a client terminal, according to some examples of the present invention;

#According to some examples of the present disclosure, there are provided systems, methods and software program products for detecting hyperlinks associated with untrusted web resources and replacing them with trusted hyperlinks associated with trusted web resources using one or more search engines.

#Before explaining at least one example of the exemplary examples in detail, it is to be understood that the disclosure is not necessarily limited in its application to the details of construction and the arrangement of the components and/or methods set forth in the following description and/or illustrated in the drawings and/or the Examples. The disclosure is capable of other examples or of being practiced or carried out in various ways.

#Reference is now made to FIG. 1, which is flowchart of an exemplary process 100 for detecting hyperlinks associated with untrusted web resources and replacing them with trusted hyperlinks associated with trusted web resources based on an analysis of search engine results at a client terminal, according to some examples of the present invention. The process 100 is executed to prevent a user using a browser or an application executed at a client terminal from browsing or otherwise accessing untrusted web resources, such as fraudulent websites, false websites, fake websites, fraudulent servers, fraudulent domains and/or the like. The process 100 is based on a classification of a hyperlink suspected as associated with an untrusted web resource according to outputs of search engine(s). In case the suspected hyperlink is classified as untrusted, a replacement hyperlink is identified and presented or used instead of the suspected hyperlink. The replacement hyperlink is selected according to an analysis of search results provided by the search engine(s) and include hyperlinks to trusted web resources, for example, legitimate websites, authentic websites, trusted websites, trusted servers, trusted domains and/or the like.