Agari Data, Inc.

Ironport Systems, Inc.

Return Path, Inc.

Patrick Richard Peterson

Bjorn Markus Jakobsson

Scott Banister

Jacob Rudee Rideout

Paul J Clegg

Peter Schlampp

Michael Olivier

Siobhán McNamara

Andrew Flury

James F Moore

Scot Free Kennedy

Craig Sprosts

John M Wilson, Iii

SeyedHossein Siadati

George Thomas Perry, Jr

A measure of influence of a sender entity is determined for a message receiving entity based at least in part on an analysis of previous electronic messages sent by the sender entity. An electronic message associated with the sender entity is received. The measure of influence of the sender entity is utilized to determine a security risk associated with the received electronic message.

Using a measure of influence of sender in determining a security risk associated with an electronic message

In one example, intelligence is gathered about an attacker that is attempting an attack via a malicious exploit message by exploiting the attacker's belief that the attack is succeeding. A received message (e.g., malicious message) sent from a first message account (e.g., attacker) to a second message account (e.g., intended victim) is received. A security risk associated with the received message is determined. It is determined that the security risk associated with the received message meets one or more criteria. Based on the determination that the security risk associated with the received message meets the one or more criteria, a responsive message is sent in response to the received message from a third message account (e.g., security service) to the first message account. The responsive message includes a content reference identified as referring to a content for a user of the first message account. In response to receiving a request made by the user of the first message account using the content reference, access to a message repository associated with the first message account is requested. Once access is granted, the message repository can be analyzed and intelligence about the first message account can be gathered and reported.

Automated intelligence gathering

Information of an electronic message to be delivered to an intended recipient is received. For an original resource identifier included in the electronic message, a corresponding alternative resource identifier that can be at least in part used to obtain the original resource identifier is determined. The original resource identifier included in the electronic message is replaced with the corresponding alternative resource identifier to generate a modified electronic message. The modified electronic message with the alternative resource identifier is allowed to be delivered to the intended recipient instead of the electronic message with the original resource identifier. An interaction associated with the original resource identifier is tracked using the alternative resource identifier.

Automated tracking of interaction with a resource of a message

Information of an electronic message to be delivered to an intended recipient is received. For an original resource identifier included in the electronic message, a corresponding alternative resource identifier that can be at least in part used to obtain the original resource identifier and obtain context information associated with the electronic message is determined. The original resource identifier included in the electronic message is replaced with the alternative resource identifier to generate a modified electronic message. The modified electronic message with the alternative resource identifier is allowed to be delivered to the intended recipient instead of the electronic message with the original resource identifier. A request made using the alternative resource identifier in the modified message triggers a security action based at least in part on the context information associated with the electronic message.

Using message context to evaluate security of requested data

Interfaces for message delivery approaches are disclosed. The interface may include pages for administering accounts for senders, pages for administering message processing systems, and pages for viewing information about senders or message processing systems. In another aspect, automatic alert mechanisms are disclosed. The alert mechanisms send a message to one or more users or machines that have been registered to receive alerts. Alerts may be triggered by any event related to a sender, a message, or a message processing system or may be triggered by any other condition or event. In another aspect, techniques for automatically disabling senders are disclosed. The automatic disabling of a sender may be triggered by any event related to a sender, a message, or a message processing system or may be triggered by any other condition or event.

Electronic message delivery with estimation approaches and complaint, bond, and statistics panels

Message delivery approaches are disclosed in which senders can define filters with associated actions for evaluation in relation to specified messages. After creating and storing filters with specified actions, senders dispatch messages to a processing system, which evaluates the filters against the messages. If a match occurs, the processing system performs the specified actions on the messages. In one embodiment, the processing system can send the same message multiple times to different receiving systems, and can modify the source IP address and outbound interface of the message for each receiving system. Further, the source IP address or interface may be modified by a filter in response to external events, such as a receiving system blocking another copy of the message. In this way, a single message processing system can appear as a large number of virtual message sending units, thereby increasing the chance that a particular message will arrive at its destination without blocking by message blocking or filtering technologies at the receiver. For bulk mailers, different filters can be associated with different communication campaigns.

Electronic message delivery using a virtual gateway approach

A method and apparatus for managing information relating to electronic messages is provided. A first set of data related to one or more message senders is obtained from a first source, such as an email sever or email gateway. Each message sender has sent one or more electronic messages. A second set of data related to the one or more message senders is obtained from a second source. Message volume information that describes the messages sent by the one or more message senders for a period of time is determined based on the first set of data and the second set of data. The message volume information may be used to determine whether a particular message sent by a particular message sender is unsolicited. If a particular message is determined to be unsolicited, various actions may be performed on messages sent by the sender of the particular message.

Collecting, aggregating, and managing information relating to electronic messages

Message delivery approaches are disclosed through which senders can guarantee that their messages are desired by intended recipients. In one embodiment, a Sender agrees with a Service Operator to pay a fine for each message that is reported as an unwanted by its Recipient. For senders that agree in advance to pay such fines, Service Operators may provide preferential message routing around 'spam' filters knowing that a guarantee is in place. If the Recipient reports that the message is unwanted, the Service Operator can penalize the Sender by a fine in the agreed amount, or by modifying a bond ratio value, rating, or other experience value associated with the Sender. Estimates of the complaints expected for a Sender may be used to determine the outcomes of the tests applied by the Receiver.

Method of electronic message delivery with penalties for unsolicited messages

Message delivery approaches in which senders define filters with associated actions for evaluation in relation to specified messages. After creating and storing filters with specified actions, senders dispatch messages to a processing system, which evaluates the filters against the messages. If a match occurs, the processing system performs the specified actions on the messages. The processing system may send the same message multiple times to different receiving systems, and may modify the source IP address and outbound interface of the message for each receiving system. The source IP address or interface may be modified by a filter in response to external events, such as a receiving system blocking another copy of the message. A single message processing system can appear as a large number of virtual message sendingunits.

Growing community of inventors

San Francisco, CA, United States of America

Patrick Richard Peterson