Ebay, Incorporated

Paypal, Inc.

Chris Lalonde

Mathew Gene Henley

Andrew Millard Brown

Quang D Pham

Kevin Black

Marty Abbott

Kirk Sanford

Greg Isaacs

Andy Brown

Scott Leahy

Jeffrey Taylor

Kevin H Embree

Ajay K Agrawal

Jeffrey Leroy King

Matthew Henley

Mat Henley

A method and system to verify active content at a server system include receiving, at the server system a communication (e.g., an e-mail message or e-commerce listing) that includes active content that is to be made accessible via the server system. At the server system, the active content is rendered to generate rendered active content. The rendered active content presents a representation of information and processes to which an end user will be subject. At the server system, the rendered active content is verified as not being malicious.

Render engine, and method of using the same, to verify data for access and/or publication via a computer system

A system for identifying perpetrators of fraudulent activity includes location logic for locating, extracting, or capturing identifying information from a client communication received from a client device. For example, the location logic may locate, or extract, a variety of message headers from an HTTP client request. The system may also include analyzer logic to analyze the identifying information, for example, by comparing the identifying information with previously captured identifying information from a previously received client communication. Finally, the system may include account identifier logic to identify user accounts associated with the previous client communication in which the same identifying information was extracted.

Identifying fraudulent activities and the perpetrators thereof

Systems and methods are disclosed herein to identify fraudulent activity. In one embodiment, a method for identifying fraudulent activity includes receiving and extracting, at a server comprising at least one hardware-based processor and a memory coupled to the at least one hardware-based processor, header information from each of a plurality of client communications issued by one or more client devices. An account is identified that is associated with each of the plurality of client communications. Header information is analyzed from each of the plurality of client communications to identify variations between the header information from different ones of the client communications. In various embodiments, a determination is made as to whether there is a similarity of the client communications and at least one previous communications associated with the account. Other systems and methods are also disclosed.

One embodiment provides a method for authenticating an electronic communication. The method includes parsing a header of the electronic communication to identify actual domain name data included in the header at a server receiving the electronic communication from a communication client; parsing the header to obtain purported sender data included in the header of the electronic communication; comparing the actual domain name data and purported sender data; and generating in response to the comparison an authenticity indicator, to provide a recipient of the electronic communication with an indication of the likelihood that the electronic communication was sent from a purported sender of the electronic communication.

Method and apparatus for authenticating electronic communication

A method and system to compare rendered publication data. The publication data are accessed from a database and then rendered to produce rendered publication data. The rendered publication data are stored to provide a reference version. After a periodic time interval, the publication data are accessed again and rendered to product a second version of rendered publication data. The reference version and the second version of rendered publication data are compared and a notification is generated when a difference exists.

Method and system to verify data received, at a server system, for access and/or publication via the server system

A method and system to verify active content in a server system include receiving a communication (e.g., an e-mail message or an e-commerce listing) that includes active content to be made accessible by the server system. A reference (e.g., a URL) within the active content is identified, the reference pointing to further data that is not included within the communication. This further data is to be retrieved when the active content is rendered. The reference is stored at the server system, and the further data, to which the reference points, is repetitively and periodically retrieved. Subsequent to each retrieval of the further data, a determination is made as to whether the further data is malicious.

Method and system to detect externally-referenced malicious data for access and/or publication via a computer system

A method and system for analyzing network traffic are provided. A network traffic analyzer includes a plurality of data switching devices connected to a plurality of data hubs. Each data hub may have multiple input ports and multiple output ports and may be configured to broadcast all data packets received at an input port to all output ports. Each data switching device may be configurable to forward data packets to an input port of any one of the plurality of data hubs, any subset of the plurality of data hubs, or all data hubs of the plurality of data hubs, based on a characteristic of one or more data packets. Furthermore, at least one network sensor device may be connected to an output port of a data hub of the plurality of data hubs. The network sensor device may be configured to analyze data packets in real time for, among other purposes, detecting network intrusions.

Method and system for analyzing network traffic

A method and system to protect users against potentially fraudulent activities associated with spoof web sites are described. According to one aspect of the present invention, the URL of a document downloaded via a web browser client is compared to the URLs in a list of URLs for known spoof sites. If the URL for the downloaded document is found in the list of URLs for known spoof sites, a security indicator is displayed to the user to indicate to the user that the downloaded document is associated with a known spoof site. According to another aspect of the invention, a security server maintains a master black list and periodically communicates updates of the master black list to the local list of a client security application.

Method and system for preventing fraudulent activities

A method includes generating an authenticity indicator for an electronic communication based on a comparison of domain name data and purported sender data associated with the electronic communication, the authenticity indicator indicating a likelihood that the electronic communication was sent from a purported sender of the electronic communication. The authenticity indicator is presented to the recipient of the electronic communication.

Growing community of inventors

Campbell, CA, United States of America

Chris Lalonde