Method and system for identifying suspected phishing websites

A system for identifying suspected phishing websites, comprising:

• one or more processors configured to:
• obtain an address of a website to be identified;
• determine, according to the address of the website to be identified, that the website to be identified is neither a protected website nor a known phishing website;
• apply a suspected phishing website rule by matching a regular expression with the address of the website to be identified, wherein the regular expression describes one or more keywords of a website to be protected and variants of the one or more keywords, wherein applying the suspected phishing website rule includes:
• extract a uniform resource locator information of a host from the address;
• determine whether there is at least one interference character in the uniform resource locator information of the host, wherein the at least one interface character comprises a symbol potentially associated with a phishing website;
• in the event that there is at least one interference character in the uniform resource locator information, modify the uniform resource locator information by deleting the at least one interference character from the uniform resource locator information of the host and performing a comparison of the regular expression to the modified uniform resource locator information of the host;
• and
• in the event that there is no interference character in the uniform resource locator information, perform a comparison of the regular expression to the uniform resource locator information of the host;
• and
• in the event that the matching between the address of the website to be identified and the regular expression is successful, determine that the website to be identified is a suspected phishing website;
• and
• one or more memories coupled to the one or more processors, to provide the one or more processors with instructions.

A computer program product for identifying suspected phishing websites, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• obtaining an address of a website to be identified;
• determining, according to the address of the website to be identified, that the website to be identified is neither a protected website nor a known phishing website;
• applying a suspected phishing website rule by matching a regular expression with the address of the website to be identified, wherein the regular expression describes one or more keywords of a website to be protected and variants of the one or more keywords, wherein applying the suspected phishing website rule includes:
• extracting a uniform resource locator information of a host from the address;
• determining whether there is at least one interference character in the uniform resource locator information of the host, wherein the at least one interface character comprises a symbol potentially associated with a phishing website;
• in the event that there is at least one interference character in the uniform resource locator information, modifying the uniform resource locator information by deleting the at least one interference character from the uniform resource locator information of the host and performing a comparison of the regular expression to the modified uniform resource locator information of the host;
• and
• in the event that there is no interference character in the uniform resource locator information, performing a comparison of the regular expression to the uniform resource locator information of the host;
• and
• in the event that the matching between the address of the website to be identified and the regular expression is successful, determining that the website to be identified is a suspected phishing website.