Method and system for tracking fraudulent activity

A method for tracking a spoof site, the method including:

• receiving data identifying a potential spoof site by a communications module of a fraud tracking server, the communications module including a web server module hosting a document with a data field to receive as input a URL representing the data identifying the potential spoof site, the communications module executing on one or more processors of the fraud tracking server;
• determining, by a URL analyzer module of the fraud tracking server, whether the received URL is associated with a previously received URL for which a spoof site tracking record already exists, the URL analyzer module executing on the one or more processors of the fraud tracking server;
• generating a spoof site tracking record in a database by a database management module of the fraud tracking server, if the potential spoof site is not associated with a previously identified spoof site for which a spoof site tracking record already exists, the spoof site tracking record including the received URL, the database management module executing on the one or more processors of the fraud tracking server;
• assigning, by a spoof page fingerprinting analyzer of the fraud tracking server, a spoof page identifier to a document associated with an actual spoof site based on unique characteristics of the document, wherein the spoof page identifier is used by the spoof page fingerprinting analyzer to compare with a second spoof page identifier of a new document to identify a source of the new document, the spoof page fingerprinting analyzer executing on the one or more processors of the fraud tracking server;
• automatically downloading source code and a screen shot of the document associated with the actual spoof site to update the spoof site tracking record;
• notifying an administrator of the actual spoof site by the communications module of the fraud tracking server;
• and
• subsequent to notifying the administrator, with a spoof site monitoring module, automatically monitoring the actual spoof site by periodically attempting to access the document associated with the actual spoof site to determine whether the actual spoof site is still active, and to update the spoof site tracking record to include data obtained during the automatic monitoring of the actual spoof site by adding to the spoof site tracking record data indicating the date and time of the last attempt to access the document and data indicating whether or not the document was accessible, the spoof monitoring module executing on the one or more processors of the fraud tracking server.

A system for tracking potentially fraudulent activity, the system including:

• a tracking database to store spoof site tracking records;
• and
• a fraud tracking server connected to the fraud tracking database, the fraud tracking server including:
• a memory;
• a processor coupled to the memory;
• a communications module to receive data identifying a potential spoof site;
• a URL analyzer to determine whether the data identifying the potential spoof site is associated with a previously identified spoof site for which a spoof site tracking record already exists;
• a database management module to generate a spoof site tracking record in the storage means, if the potential spoof site is not associated with a previously identified spoof site for which a spoof site tracking record already exists, the spoof site tracking record including the data identifying the potential spoof site;
• a spoof page fingerprinting analyzer to assign a spoof page identifier to a document associated with a actual spoof site based on unique characteristics of the document, wherein the spoof page identifier is used to compare with a second spoof page identifier of a new document to identify a source of the new document;
• wherein source code and a screen shot of the document associated with the actual spoof site is automatically downloaded to update the spoof site tracking record, and wherein the communications module is to notify an administrator of the potential spoof site;
• and the fraud tracking server further including
• a spoof site monitoring module to automatically monitor the actual spoof site to determine whether the actual spoof site is still active by periodically attempting to access the document associated with the spoof site, and to update the spoof site tracking record to include data obtained during the automatic monitoring of the actual spoof site by adding to the spoof site tracking record data indicating the date and time of the last attempt to access the document and data indicating whether or not the document was accessible.