# US 12,003,537 B2 · Mitigating phishing attempts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,537 B2 - Document ID: US12003537B2 - Status: Granted - Kind: B2 - Application number: 17/353,669 - Filed: 2021-06-21 - Published: 2021-10-07 - Granted: 2024-06-04 - Earliest claimed: 2016-08-26 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Wei Xu - Web page: https://patentgrep.com/patent/US12003537B2 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Credential phishing attack mitigation is disclosed. A URL that is associated with a suspected credential phishing web page is received. The suspected credential phishing web page is one that includes at least one element soliciting at least one credential. The URL is included in a message having at least one intended recipient. An artificial credential is provided to the suspected credential phishing web page. An indication is received that, subsequent to providing the artificial credential to the suspected credential phishing web page, an attempted use of the artificial credential to access a resource was made. In response to receiving the indication that the attempted use of the artificial credential to access the resource has been made, at least one remedial action is taken with respect to the suspected credential phishing web page. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive, in association with analysis of an electronic communication having an intended recipient, a URL that is associated with a suspected credential phishing web page hosted by a server, wherein the suspected credential phishing web page includes at least one element soliciting at least one credential; provide an artificial credential to the suspected credential phishing web page, wherein the artificial credential comprises a generated password, and wherein the artificial credential, when supplied during a request to access a resource, indicates that the attempted access to the resource is unauthorized; and receive an indication that, subsequent to providing the artificial credential to the suspected credential phishing web page, an attempted use of the artificial credential to access the resource was made and in response, determine whether a legitimate end user attempted to access the server at a time prior to the attempted use of the artificial credential, and take at least one remedial action with respect to at least one of the server or the legitimate end user; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the indication that the attempted use of the artificial credential to access the resource was made is received in response to a determination that an authorization attempt was made against an authentication server. ### Claim 3 (depends on 1) The system of claim 1, wherein the processor is further configured to identify a set of additional recipients that received the URL. ### Claim 4 (depends on 3) The system of claim 3, wherein the processor is further configured to identify the set of additional recipients at least in part by tracking email addresses to which the URL was sent. ### Claim 5 (depends on 1) The system of claim 1, wherein the processor is further configured to generate the artificial credential. ### Claim 6 (depends on 5) The system of claim 5, wherein the processor is configured to generate the artificial credential by using a randomizer. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor is configured to generate an artificial login by selecting from a common username directory. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor is further configured to quarantine any messages including the received URL from reaching legitimate end users until a determination is made about whether the suspected credential phishing web page should be confirmed as a confirmed credential phishing web page. ### Claim 9 (depends on 1) The system of claim 1, wherein the at least one remedial action includes preventing the URL from being transmitted to legitimate end users. ### Claim 10 (depends on 1) The system of claim 1, wherein the at least one remedial action includes blacklisting the URL. ### Claim 11 (depends on 1) The system of claim 1, wherein the processor is further configured to determine whether any recipients of the URL accessed the suspected credential phishing web page. ### Claim 12 (depends on 11) The system of claim 11, wherein the at least one remedial action includes preventing any recipients of the URL that accessed the suspected credential phishing web page from accessing the resource. ### Claim 13 (depends on 1) The system of claim 1, wherein the at least one remedial action includes requiring the legitimate end user to change a password. ### Claim 14 (depends on 11) The system of claim 11, wherein the at least one remedial action includes flagging the server as compromised. ### Claim 15 A method, comprising: receiving, in association with analysis of an electronic communication having an intended recipient, a URL that is associated with a suspected credential phishing web page hosted by a server, wherein the suspected credential phishing web page includes at least one element soliciting at least one credential; providing an artificial credential to the suspected credential phishing web page, wherein the artificial credential comprises a generated password, and wherein the artificial credential, when supplied during a request to access a resource, indicates that the attempted access to the resource is unauthorized; and receiving an indication that, subsequent to providing the artificial credential to the suspected credential phishing web page, an attempted use of the artificial credential to access the resource was made and in response, determining whether a legitimate end user attempted to access the server at a time prior to the attempted use of the artificial credential, and taking at least one remedial action with respect to at least one of the server or the legitimate end user. ### Claim 16 (depends on 15) The method of claim 15, wherein the indication that the attempted use of the artificial credential to access the resource was made is received in response to a determination that an authorization attempt was made against an authentication server. ### Claim 17 (depends on 15) The method of claim 15, further comprising identifying a set of additional recipients that received the URL. ### Claim 18 (depends on 17) The method of claim 17, wherein identifying the set of additional recipients includes tracking email addresses to which the URL was sent. ### Claim 19 (depends on 15) The method of claim 15, further comprising generating the artificial credential. ### Claim 20 (depends on 15) The method of claim 15, further comprising generating an artificial login by selecting from a common username directory. ### Claim 21 A computer program product comprising a non-transitory tangible computer readable storage medium and comprising computer instructions for: receiving, in association with analysis of an electronic communication having an intended recipient, a URL that is associated with a suspected credential phishing web page hosted by a server, wherein the suspected credential phishing web page includes at least one element soliciting at least one credential; providing an artificial credential to the suspected credential phishing web page, wherein the artificial credential comprises a generated password, and wherein the artificial credential, when supplied during a request to access a resource, indicates that the attempted access to the resource is unauthorized; receiving an indication that, subsequent to providing the artificial credential to the suspected credential phishing web page, an attempted use of the artificial credential to access the resource was made and in response, determining whether a legitimate end user attempted to access the server at a time prior to the attempted use of the artificial credential, and taking at least one remedial action with respect to at least one of the server or the legitimate end user. ### Claim 22 (depends on 19) The method of claim 19, wherein generating the artificial credential includes using a randomizer. ### Claim 23 (depends on 15) The method of claim 15, further comprising quarantining any messages including the received URL from reaching legitimate end users until a determination is made about whether the suspected credential phishing web page should be confirmed as a confirmed credential phishing web page. ### Claim 24 (depends on 15) The method of claim 15, wherein the at least one remedial action includes preventing the URL from being transmitted to legitimate end users. ### Claim 25 (depends on 15) The method of claim 15, wherein the at least one remedial action includes blacklisting the URL. ### Claim 26 (depends on 15) The method of claim 15, further comprising determining whether any recipients of the URL accessed the suspected credential phishing web page. ### Claim 27 (depends on 26) The method of claim 26, wherein the at least one remedial action includes preventing any recipients of the URL that accessed the suspected credential phishing web page from accessing the resource. ### Claim 28 (depends on 15) The method of claim 15, wherein the at least one remedial action includes requiring the legitimate end user to change a password. ### Claim 29 (depends on 26) The method of claim 26, wherein the at least one remedial action includes flagging the server as compromised.