# US 12,224,983 B2 · Detecting and preventing transmission of spam messages using modified source numbers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,983 B2 - Document ID: US12224983B2 - Status: Granted - Kind: B2 - Application number: 17/324,952 - Filed: 2021-05-19 - Published: 2022-05-05 - Granted: 2025-02-11 - Earliest claimed: 2020-10-29 - Assignees: Proofpoint, Inc. - Applicants: Proofpoint, Inc. - Inventors: Thomas Lee - Web page: https://patentgrep.com/patent/US12224983B2 ## CPC - H04L 51/063: Content adaptation, e.g. replacement of unsuitable content - H04L 63/0245: {Filtering by information in the payload} - H04L 51/212: using filtering or selective blocking - H04L 51/214: using selective forwarding - H04L 51/48: Message addressing, e.g. address format or anonymous messages, aliases - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06N 20/00: Machine learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Aspects of the disclosure relate to detecting and preventing transmission of spam messages using modified source numbers. A computing platform may detect that a first message, sent to a recipient device from a sender device, includes suspicious content. Subsequently, the computing platform may receive, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply message in response to the first message. Then, the computing platform may generate a modified message by modifying a first source number corresponding to the reply message. Next, the computing platform may cause transmission of the modified message with the modified first source number to the sender device. Thereafter, the computing platform may intercept one or more additional messages between the sender device and the modified first source number and redirect the one or more additional messages. ## Claims ### Claim 1 A computing platform, comprising: at least one processor; a communication interface communicatively coupled to the at least one processor; and memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: detect that a first character-limited message, sent to a recipient device from a sender device, comprises suspicious content, wherein the detection includes the computing platform scanning or evaluating a content of the first character-limited message, the recipient device being different from the computing platform; subsequent to detecting that the first character-limited message comprises suspicious content, delivering the first character-limited message to the recipient device; receive, via the communication interface, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply character-limited message in response to the first character-limited message; generate a modified character-limited message by modifying a first source phone number associated with the recipient device and corresponding to the reply character-limited message; cause transmission of the modified character-limited message with the modified first source phone number to the sender device; intercept one or more additional character-limited messages sent by the sender device and to the modified first source phone number; and redirect the one or more additional character-limited messages. ### Claim 2 (depends on 1) The computing platform of claim 1, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: based on receiving the user interaction information, transmit an instruction, to a messaging service center, that causes the messaging service center to drop the reply character-limited message. ### Claim 3 (depends on 1) The computing platform of claim 1, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: classify the first character-limited message as potential spam, spam, or non-spam. ### Claim 4 (depends on 1) The computing platform of claim 1, wherein redirecting the one or more additional character-limited messages comprises redirecting the one or more additional character-limited messages to a honeypot. ### Claim 5 (depends on 1) The computing platform of claim 1, wherein redirecting the one or more additional character-limited messages comprises redirecting the one or more additional character-limited messages to a security policy enforcement entity. ### Claim 6 (depends on 1) The computing platform of claim 1, wherein modifying the first source phone number corresponding to the reply character-limited message comprises rewriting a phone number associated with the recipient device. ### Claim 7 (depends on 6) The computing platform of claim 6, wherein rewriting the phone number associated with the recipient device comprises rewriting the phone number to correspond to a honeypot. ### Claim 8 (depends on 1) The computing platform of claim 1, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to: train one or more machine learning algorithms using the intercepted one or more additional character-limited messages received from the sender device. ### Claim 9 (depends on 1) The computing platform of claim 1, wherein detecting that the first character-limited message comprises suspicious content further includes: prior to delivering the first character-limited message to the recipient device, modifying a second source phone number corresponding to the first character-limited message sent to the recipient device, and wherein delivering the first character-limited message to the recipient device includes sending the first character-limited message with the modified second source phone number to the recipient device, the modified second source phone number indicating that the first character-limited message comprises suspicious content. ### Claim 10 (depends on 1) The computing platform of claim 1, wherein the first character-limited message comprises at least one of a short message service (SMS) message or a multimedia messaging service (MMS) message. ### Claim 11 A method, comprising: at a computing platform comprising at least one processor, a communication interface, and memory: detecting, by the at least one processor, that a first character-limited message, sent to a recipient device from a sender device, comprises suspicious content, wherein the detecting includes the computing platform scanning or evaluating a content of the first character-limited message; subsequent to detecting that the first character-limited message comprises suspicious content, delivering the first character-limited message to the recipient device; receiving, by the at least one processor, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply character-limited message in response to the first character-limited message; generating, by the at least one processor, a modified character-limited message by modifying a first source phone number associated with the recipient device and corresponding to the reply character-limited message; causing transmission, by the at least one processor, of the modified character-limited message with the modified first source phone number to the sender device; intercepting, by the at least one processor, one or more additional character-limited messages sent by the sender device and to the modified first source phone number; and redirecting, by the at least one processor, the one or more additional character-limited messages. ### Claim 12 (depends on 11) The method of claim 11, further comprising: based on receiving the user interaction information, transmitting an instruction, to a messaging service center, that causes the messaging service center to drop the reply character-limited message. ### Claim 13 (depends on 11) The method of claim 11, further comprising: classifying the first character-limited message as potential spam, spam, or non-spam. ### Claim 14 (depends on 11) The method of claim 11, wherein redirecting the one or more additional character-limited messages comprises redirecting the one or more additional character-limited messages to a honeypot. ### Claim 15 (depends on 11) The method of claim 11, wherein redirecting the one or more additional character-limited messages comprises redirecting the one or more additional character-limited messages to a security policy enforcement entity. ### Claim 16 (depends on 11) The method of claim 11, wherein modifying the first source phone number corresponding to the reply character-limited message comprises rewriting a phone number associated with the recipient device. ### Claim 17 (depends on 16) The method of claim 16, wherein rewriting the phone number associated with the recipient device comprises rewriting the phone number to correspond to a honeypot. ### Claim 18 (depends on 11) The method of claim 11, further comprising: training one or more machine learning algorithms using the intercepted one or more additional character-limited messages received from the sender device. ### Claim 19 (depends on 11) The method of claim 11, wherein detecting that the first character-limited message comprises suspicious content further includes: prior to delivering the first character-limited message to the recipient device, modifying a second source phone number corresponding to the first character-limited message sent to the recipient device, and wherein delivering the first character-limited message to the recipient device includes sending the first character-limited message with the modified second source phone number to the recipient device, the modified second source phone number indicating that the first character-limited message comprises suspicious content. ### Claim 20 One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to: detect that a first character-limited message, sent to a recipient device from a sender device, comprises suspicious content, wherein the detection includes the computing platform scanning or evaluating a content of the first character-limited message; subsequent to detecting that the first character-limited message comprises suspicious content, deliver the first character-limited message to the recipient device; receive, via the communication interface, from the recipient device, user interaction information indicating that a user of the recipient device has sent a reply character-limited message in response to the first character-limited message; generate a modified character-limited message by modifying a first source phone number associated with the recipient device and corresponding to the reply character-limited message; cause transmission of the modified character-limited message with the modified first source phone number to the sender device; intercept one or more additional character-limited messages sent by the sender device and to the modified first source phone number; and redirect the one or more additional character-limited messages.