Detection of phishing dropboxes

A computing device comprising:

• at least one processor;
• at least one data storage device coupled to the at least one processor;
• a network interface coupled to the at least one processor and to a computer network;
• a plurality of processes spawned by said at least one processor, the processes including processing logic for:
• receiving, over a computer network, an email comprising a link to a fraudulent website of a counterfeited brand, the fraudulent website comprising at least one login page that comprises at least one field configured to accept user credentials;
• determining constraints on the user credentials that must be satisfied for the user credentials to be accepted by the fraudulent website when input into the at least one field;
• randomly generating at least some marker elements that satisfy the determined constraints;
• using the randomly-generated marker elements, generating fake user credentials that satisfy the determined constraints;
• assembling the generated fake user credentials into a marker that is specific to the counterfeited brand and to the fraudulent website;
• programmatically inputting the generated fake user credentials into the at least one field of the at least one login page of the fraudulent website;
• and
• publishing the marker injected into the fraudulent website to known email service providers.

A computer-implemented method of detecting a phishing dropbox, comprising:

• receiving a plurality of incoming emails over a computer network, at least some of the received plurality of emails being legitimate emails and at least some of the plurality of received emails comprising stolen user credentials;
• receiving at least one email comprising a marker, the marker comprising generated or selected high entropy, random fake user credentials that were previously injected into a fraudulent website;
• filtering the incoming emails for one containing data that matches at least portions of the fake user credentials in the received at least one email comprising the marker;
• identifying an email address of an incoming email that contains the matching data as being an email address of a phishing dropbox;
• and
• routing the received plurality of emails to respective inboxes, according to email addresses of the received plurality of emails.