# US 2021/0241281 A1 · System and method for identifying suspicious destinations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0241281 A1 - Document ID: US20210241281A1 - Status: Published application - Kind: A1 - Application number: 17/162,039 - Filed: 2021-01-29 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Royal Bank of Canada - Applicants: Royal Bank of Canada - Inventors: Jamie GAMBLE; Gadi SHPITS; Ilya KOLMANOVICH; Cormac O'KEEFFE - Web page: https://patentgrep.com/patent/US20210241281A1 ## CPC - G06Q 20/4016: {involving fraud or risk level assessment in transaction processing} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - G06Q 20/4014: {Identity check for transactions} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/102: {Entity profiles} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Transaction destinations are identified by identifying requests for a login page of a web server for a financial institution and determining a referring website for each of the requests; classifying the referring websites into classes, each of the classes having a risk rating; identifying logins to access the web server and determining a user associated with each login; associating each of the logins with one of the requests and the referring website for that request; for each of the users, identifying transactions occurring within a time period from when the login was initiated; for each of the transactions occurring within the time period, associating a transaction destination of that transaction with the referring website for that login; and assigning a risk rating to each of the transaction destinations based at least in part on a risk rating of the class of the associated referring website. ## Claims ### Claim 1 A computer-implemented method for identifying transaction destinations, comprising: identifying requests for a login page of a web server for a financial institution and determining a referring website for each of the requests; classifying the referring websites into classes, each of the classes having a risk rating; identifying logins to access the web server and determining a user associated with each login; associating each of the logins with one of the requests and the referring website for that request; for each of the users, identifying transactions occurring within a time period from when the login was initiated; for each of the transactions occurring within the time period, associating a transaction destination of that transaction with the referring website for that login; and assigning a risk rating to each of the transaction destinations based at least in part on a risk rating of the class of the associated referring website. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the determining the referring website comprises extracting an identifier of the referring website web server logs from the financial institution. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the requests are HTTP requests. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the determining the referring website comprises extracting an identifier of the referring website from HTTP referrer header information. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the associating each of the logins with one of the requests and the referring website for that request is based at least in part on comparing a time stamp of the login and a time stamp of the request. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the associating each of the logins with one of the requests and the referring website for that request is based at least in part on a cookie upon login linking an account of the user with a browser of the user. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the determining the user associated with each login is based at least in part on an IP address in a web server log. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the determining the user associated with each login is based at least in part on an IP address in a HTTP request. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising, grouping users from a common class of the referring websites and identifying, for each of the groups of users, a common transaction destination. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the common transaction destination is identified from the destinations containing a common word. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the time period is between ten and thirty minutes. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein the time period is twenty minutes. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein the risk ratings of the classes are based at least in part on a whitelist of websites. ### Claim 14 (depends on 1) The computer-implemented method of claim 1, wherein the transaction destination of at least one of the transactions is an identification of an entity. ### Claim 15 (depends on 1) The computer-implemented method of claim 1, wherein the transaction destination of at least one of the transactions is a bank account. ### Claim 16 (depends on 1) The computer-implemented method of claim 1, further comprising identifying additional transactions that send funds to one or more of the transaction destinations. ### Claim 17 (depends on 16) The computer-implemented method of claim 16, further comprising assigning a risk rating to the additional transactions based at least in part on the risk ratings of the transaction destinations. ### Claim 18 (depends on 1) The computer-implemented method of claim 1, further comprising for each of the transactions, identifying a transaction type and assigning a risk rating to the transaction type based at least in part on the risk rating of the transaction destination. ### Claim 19 (depends on 1) A computer system comprising: a processor; and a memory in communication with the processor, the memory storing instructions that, when executed by the processor cause the processor to perform the method of claim 1. ### Claim 20 (depends on 1) A non-transitory computer-readable medium having computer executable instructions stored thereon for execution by one or more computing devices, that when executed perform the method of claim 1.