# US 12,015,639 B2 · Systems and methods for polluting phishing campaign responses > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,639 B2 - Document ID: US12015639B2 - Status: Granted - Kind: B2 - Application number: 17/538,329 - Filed: 2021-11-30 - Published: 2022-05-26 - Granted: 2024-06-18 - Earliest claimed: 2018-08-09 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Brian Michael Wilcox - Web page: https://patentgrep.com/patent/US12015639B2 ## CPC - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 40/174: Form filling; Merging - G06F 40/205: Parsing - G06Q 10/107: Computer-aided management of electronic mailing [e-mailing] - H04L 51/212: using filtering or selective blocking - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 2463/146: Tracing the source of attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Techniques for polluting phishing campaign responses with content that includes fake sensitive information of a type that is being sought in phishing messages. Embodiments disclosed herein identify phishing messages that are designed to fraudulently obtain sensitive information. Rather than simply quarantining these phishing messages from users' accounts to prevent users from providing “real” sensitive information, embodiments disclosed herein analyze these phishing messages to determine what type(s) of information is being sought and then respond to these phishing messages with “fake” sensitive information of these type(s). For example, if a phishing message is seeking sensitive credit card and/or banking account information, some fake information of this type(s) may be generated and sent in response to the phishing message. In various implementations, a natural language processing (NLP) model may be used to analyze the phishing message and/or generate a response thereto. ## Claims ### Claim 1 A computer-implemented method, comprising: identifying, from at least one first data file stored in a real account, at least one property exhibited by the at least one first data file; generating at least one second data file that exhibits the at least one property, wherein the at least one second data file is generated based on at least one predefined parameter configured to identify sensitive content, in the at least one first data file, that is to be omitted from the at least one second data file; populating a false account with the at least one second data file; receiving, from a computing device, an access request that includes at least one credential that corresponds to the false account; and responsive to receiving the access request that includes the at least one credential, provisioning the computing device with access to the at least one second data file via the false account. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, from the computing device, a message that is addressed to the real account; and causing a seed response that includes the at least one credential to be transmitted to the computing device in response to receiving the message. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the at least one second data file comprises at least one false data file, the method further comprising deploying a false tenant model to populate the false account with the at least one false data file. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising determining, based on computing activity that occurs in association with the false account, configuration data that corresponds to the computing device. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the configuration data includes an Internet Protocol (IP) address associated with the computing device. ### Claim 6 (depends on 4) The computer-implemented method of claim 4, wherein the configuration data includes a browser configuration corresponding to a web browser that is operating on the computing device. ### Claim 7 (depends on 4) The computer-implemented method of claim 4, wherein the configuration data includes a plug-in that is operating on the computing device. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the at least one predefined parameter is defined by a tenant of a system performing the computer-implemented method. ### Claim 9 A system, comprising: at least one processor; and memory having computer-readable instructions stored thereupon that, when executed by the at least one processor, cause the at least one processor to: identify, from at least one first data file stored in a real account, at least one property exhibited by the at least one first data file; generate at least one second data file that exhibits the at least one property, wherein the at least one second data file is generated based on at least one predefined parameter configured to identify sensitive content, in the at least one first data file, that is to be omitted from the at least one second data file; populate a false account with the at least one second data file; receive, from a computing device, an access request that includes at least one credential that corresponds to the false account; and responsive to receiving the access request that includes the at least one credential, provision the computing device with access to the at least one second data file via the false account. ### Claim 10 (depends on 9) The system of claim 9, wherein the computer-readable instructions further cause the at least one processor to: receive, from the computing device, a message that is addressed to the real account; and cause a seed response that includes the at least one credential to be transmitted to the computing device in response to receiving the message. ### Claim 11 (depends on 9) The system of claim 9, wherein the at least one second data file comprises at least one false data file, the computer-readable instructions further causing the at least one processor to deploy a false tenant model to populate the false account with the at least one false data file. ### Claim 12 (depends on 9) The system of claim 9, wherein the computer-readable instructions further cause the at least one processor to determine, based on computing activity that occurs in association with the false account, configuration data that corresponds to the computing device. ### Claim 13 (depends on 12) The system of claim 12, wherein the configuration data includes an Internet Protocol (IP) address associated with the computing device. ### Claim 14 (depends on 12) The system of claim 12, wherein the configuration data includes a browser configuration corresponding to a web browser that is operating on the computing device. ### Claim 15 (depends on 12) The system of claim 12, wherein the configuration data includes a plug-in that is operating on the computing device. ### Claim 16 (depends on 9) The system of claim 9, wherein the at least one predefined parameter is defined by a tenant of the system. ### Claim 17 One or more computer storage media having computer-readable instructions stored thereupon that, when executed by at least one processor, cause a system to: identify, from at least one first data file stored in a real account, at least one property exhibited by the at least one first data file; generate at least one second data file that exhibits the at least one property, wherein the at least one second data file is generated based on at least one predefined parameter configured to identify sensitive content, in the at least one first data file, that is to be omitted from the at least one second data file; populate a false account with the at least one second data file; receive, from a computing device, an access request that includes at least one credential that corresponds to the false account; and responsive to receiving the access request that includes the at least one credential, provision the computing device with access to the at least one second data file via the false account. ### Claim 18 (depends on 17) The one or more computer storage media of claim 17, wherein the computer-readable instructions further cause the system to: receive, from the computing device, a message that is addressed to the real account; cause a seed response that includes the at least one credential to be transmitted to the computing device in response to receiving the message. ### Claim 19 (depends on 17) The one or more computer storage media of claim 17, wherein the computer-readable instructions further cause the system to determine, based on computing activity that occurs in association with the false account, configuration data that corresponds to the computing device, wherein the configuration data includes an Internet Protocol (IP) address associated with the computing device, a browser configuration corresponding to a web browser that is operating on the computing device, or a plug-in that is operating on the computing device. ### Claim 20 (depends on 17) The one or more computer storage media of claim 17, wherein the at least one predefined parameter is defined by a tenant of the system.