| 摘要 |
A method and apparatus for detecting malware containing e-mails based on inconsistencies between a governmental agency "From" address and a sending IP address whereby an incoming e-mail is analyzed to determine if the incoming e-mail includes a "From" address having a domain suffix that is normally associated with a governmental agency, such as a .gov, .gov.uk, .go.jp, or any similar governmental domain suffix. The connecting IP address or IP addresses within the received headers associated with the incoming e-mail are then analyzed to determine the geographical locations through which the incoming e-mail passed. If the geographical locations associated with these sending IP addresses of the incoming e-mail are not consistent with the country indicated by the domain suffix in the governmental "From" address of the incoming e-mail then the protective action is taken.
|
