System and method for detection and mitigation of network-based computing threats

A computer security method comprising:

• crawling a plurality of webpages respectively at a plurality of network addresses on a network;
• capturing a plurality of images of the plurality of webpages, each of the plurality of webpages corresponding to at least one of the plurality of images;
• determining a plurality of identifiers based on the plurality of images and the plurality of network addresses;
• detecting a particular webpage at a particular network address;
• determining that the particular webpage includes at least one mechanism for user data extraction;
• capturing at least one particular image of the particular webpage responsive to the determining that the particular webpage includes the at least one mechanism for user data extraction;
• determining at least one particular identifier based on the at least one particular image and the particular network address;
• comparing the at least one particular identifier to the plurality of identifiers;
• and
• controlling access by a particular computing device to the particular webpage based on the comparing of the at least one particular identifier to the plurality of identifiers.

A network-enabled threat mitigation system comprising:

• a first computing system comprising at least a first processor and at least a first non-transitory computer readable storage medium having encoded thereon first instructions that when executed by the at least the first processor cause the first computing system to perform a first process comprising:
• crawling a plurality of webpages respectively at a plurality of network addresses on a network;
• capturing a plurality of images of the plurality of webpages, each of the plurality of webpages corresponding to at least one of the plurality of images;
• and
• determining a plurality of identifiers based on the plurality of images and the plurality of network addresses;
• a second computing system comprising at least a second processor and at least a second non-transitory computer readable storage medium having encoded thereon second instructions that when executed by the at least the second processor cause the second computing system to perform a second process comprising:
• receiving the plurality of identifiers from the first computing system;
• detecting access to a particular webpage at a particular network address via a particular browser;
• determining via the particular browser that the particular webpage includes at least one mechanism for user data extraction;
• capturing via the particular browser at least one particular image of the particular webpage responsive to the determining that the particular webpage includes the at least one mechanism for user data extraction;
• and
• controlling the access to the particular webpage via the particular browser based on the plurality of identifiers, the at least one particular image, and the particular network address.