Abstract: Methods for determining user intent at a website and responding to it include using one or more processors to fetch a referral URL, associated with a prior website, from one or more web server logs associated with a web server. The referral URL is provided to the web server in conjunction with a user navigating from the prior website to a current website using a browser. The processor(s) determine whether the prior website is fraudulent based at least in part on determining whether the referral URL matches a URL in one or more data stores and/or receiving an indication from a machine learning (ML) engine indicating whether the prior website is fraudulent. If prior website is not fraudulent, the processor(s) process one or more user requests at the current website. If the prior website is fraudulent the processor(s) block the user request(s). Related systems are configured to implement the methods.

Abstract: Disclosed herein are systems and methods for automatic takedown of counterfeit websites using API-based and/or email-based takedown. In implementations the method includes checking the domain of a Uniform Resource Locator (URL) against a database to determine if an API-based takedown can be performed for the counterfeit website. If an API-based takedown cannot be performed the system determines the email of the hosting provider hosting the counterfeit website based on the resolve Internet Protocol (IP) address and sends a takedown notification via email with evidence such as screenshots, hosting infrastructure information, website lifecycle and scan timestamp. The system checks periodically whether the counterfeit website has been taken down by the network owner. If, after a check, the website is still live, the process of takedown is repeated until the website is taken down.

Abstract: Counterfeit uniform resource locators (URLs) are detected and blocked in real-time by a browser extension in communication with a counterfeit URL detection system. The browser extension receives a URL requested within a browser application. Content from a webpage associated with the received URL is extracted and transmitted to the counterfeit URL detection system, which is configured to analyze the content and return an assessment indicating whether the URL is counterfeit. If the assessment indicates that the URL is counterfeit, the browser extension blocks the browser application from accessing content associated with the URL.

Abstract: Counterfeit uniform resource locators (URLs) are detected and blocked in real-time by a browser extension in communication with a counterfeit URL detection system. The browser extension receives a URL requested within a browser application. Content from a webpage associated with the received URL is extracted and transmitted to the counterfeit URL detection system, which is configured to analyze the content and return an assessment indicating whether the URL is counterfeit. If the assessment indicates that the URL is counterfeit, the browser extension blocks the browser application from accessing content associated with the URL and redirects the browser extension to a legitimate URL.