Detecting realtime phishing from a phished client or at a security server

A non-transitory computer readable storage medium for tangibly storing computer program instructions capable of being executed by a computer processor, the computer program instructions defining the steps of:

• receiving a request for a webpage from a client device;
• generating and inserting an encoded tracking value (ETV) into the webpage, the ETV comprising a unique value generated based on the request;
• inserting dynamic tracking code (DTC) into the webpage, the inserting of the DTC further comprising obfuscating the DTC by modifying a first form of the DTC to a second form;
• and
• returning the webpage including the ETV and DTC to the client device, the DTC configured to execute upon receipt at the client device and validate the ETV upon executing.

An apparatus comprising:

• a processor;
• and
• a storage medium for tangibly storing thereon program logic for execution by the processor, the stored program logic causing the processor to perform the operations of:
• receiving a request for a webpage from a client device;
• generating and inserting an encoded tracking value (ETV) into the webpage, the ETV comprising a unique value generated based on the request;
• inserting dynamic tracking code (DTC) into the webpage, the inserting of the DTC further comprising obfuscating the DTC by modifying a first form of the DTC to a second form;
• and
• returning the webpage including the ETV and DTC to the client device, the DTC configured to execute upon receipt at the client device and validate the ETV upon executing.