Systems and methods for protection against theft of user credentials by email phishing attacks

A method for protection against theft of user credentials comprising:

• identifying, by a computer system, a company name included in a received email;
• identifying, by the computer system, a link in the received email;
• extracting, by the computer system, a domain name from the identified link;
• searching, by the computer system, a linkmap for an existing record associated with the identified company name, wherein the linkmap comprises a collection of records, the records relating names of companies to trusted domain names;
• determining, by the computer system, if the extracted domain name matches a trusted domain name of the existing record;
• and
• creating a new record, if the search of the linkmap fails to provide the existing record, wherein the new record comprises an identification of a recipient of the email, the identified company name, the extracted domain name, and a timestamp.

A non-transitory computer readable medium storing executable sequences of instructions to provide protection against theft of user credentials, the sequences of instructions comprising instructions to:

• identify a company name included in a received email;
• identify a link in the received email;
• extract a domain name from the identified link;
• search a linkmap for an existing record associated with the identified company name, wherein the linkmap comprises a collection of records, the records relating names of companies to trusted domain names;
• determine if the extracted domain name matches a trusted domain name of the existing record;
• if the domain name matches the trusted domain name, identify the received email as genuine in response to the determination of a match;
• and
• if the search of the linkmap fails to provide the existing record, create a new record comprising an identification of a recipient of the email, the identified company name, the extracted domain name, and a timestamp.