Abstract: A system comprising email processing circuitry, web server circuitry, third-party interface circuitry, and a database, wherein the database stores information about a plurality of users. The system receives, via a network, a first email message and generates a modified first email message by insertion of a link to remotely-hosted content in the received email message. The system transmits, via a network interface, the modified first email message. The system receives, via a network, a request for the remotely-hosted content, and updates the database based on information contained in the request for the remotely-hosted content. The system receives, via a network, information about activity on a third-party system, and updates the database based on the information about activity on the third-party system. The system receives a second email message, determines an action to take on the second email message based on information in the database, and takes the action.

Abstract: A message handling system comprising connection handler circuitry, message parser circuitry, message modification circuitry, message processing circuitry, and content caching circuitry, wherein the message parser circuitry is operable to extract header(s) and/or content of a received message. The message modification circuitry is operable to generate a modified message by inserting, into the message, an HTML tag comprising a first unique uniform resource locator (URL). The connection handler circuitry is operable to send the modified message to a device that handles messages for the recipient. The message processing circuitry is operable to analyze the one or more headers and/or content. The message processing circuitry is operable to determine which image of a plurality of images to serve in response to a request containing the first unique URL, wherein the determination is based on the analysis of the one or more headers and/or content.

Abstract: In accordance with an example implementation of this disclosure, an email handler comprises email processing circuitry, a web server, and a database. The email processing circuitry is operable to generate a uniform resource locator for a notification object to be embedded in an email message. The email processing circuitry is operable to embed the notification object in the email message. The email processing circuity is operable to send the email message into a network. The web server is operable to receive a request sent to the uniform resource locator by a client device, The web server is operable to determine characteristics of the client device based on content of the request. The web server is operable to store the characteristics in the database. The web server is operable to control access to content by the client device based on characteristics of the client device stored in the database.

Abstract: A mail transfer agent comprises processing circuitry, storage circuitry, and networking circuitry. The storage circuitry holds a database. The networking circuitry is operable to receive, via a network connection, an email message. The processing circuitry is operable to analyze the email message to detect an image present in the email message. The processing circuitry is operable to determine, based on one or more records of the database, that the detected image is associated with a particular brand, and process the email message based on whether one or more characteristics of the email message are associated with the particular brand in the database. The one or more characteristics of the email message may comprise one or more of: sender domain, sender subdomain, and sender IP address.

Abstract: A message handling system comprising connection handler circuitry, message parser circuitry, message modification circuitry, message processing circuitry, and content caching circuitry, wherein the message parser circuitry is operable to extract header(s) and/or content of a received message. The message modification circuitry is operable to generate a modified message by inserting, into the message, an HTML tag comprising a first unique uniform resource locator (URL). The connection handler circuitry is operable to send the modified message to a device that handles messages for the recipient. The message processing circuitry is operable to analyze the one or more headers and/or content. The message processing circuitry is operable to determine which image of a plurality of images to serve in response to a request containing the first unique URL, wherein the determination is based on the analysis of the one or more headers and/or content.

Abstract: A system comprising email processing circuitry, web server circuitry, third-party interface circuitry, and a database, wherein the database stores information about a plurality of users. The system receives, via a network, a first email message and generates a modified first email message by insertion of a link to remotely-hosted content in the received email message. The system transmits, via a network interface, the modified first email message. The system receives, via a network, a request for the remotely-hosted content, and updates the database based on information contained in the request for the remotely-hosted content. The system receives, via a network, information about activity on a third-party system, and updates the database based on the information about activity on the third-party system. The system receives a second email message, determines an action to take on the second email message based on information in the database, and takes the action.

Abstract: A malware detection system based on stored data that analyzes an electronic message for threats by comparing it to previously received messages in a message archive or to a contacts list. Threat protection rules may be generated dynamically based on the message and contacts history. A message that appears suspicious may be blocked, or the system may insert warnings to the receiver not to provide personal information without verifying the message. Threat checks may look for unknown senders, senders with identities that are similar to but not identical to previous senders or to known contacts, or senders that were added only recently as contacts. Links embedded in messages may be checked by comparing them to links previously received or to domain names of known contacts. The system may flag messages as potential threats if they contradict previous messages, or if they appear unusual compared to the patterns of previous messages.

Abstract: Among other things, an aspect includes a data storage system associated with a provider entity and storing data on behalf of a client entity, the data being accessible from the data storage system by the client entity, a data interface enabling access by the provider entity to the data of the data storage system, and an analysis engine maintained by the provider entity to, at times determined by the analysis engine, access the data using the data interface, analyze the data, and generate results of the analysis for use by the client entity.

Abstract: A malware detection system based on stored data that analyzes an electronic message for threats by comparing it to previously received messages in a message archive or to a contacts list. Threat protection rules may be generated dynamically based on the message and contacts history. A message that appears suspicious may be blocked, or the system may insert warnings to the receiver not to provide personal information without verifying the message. Threat checks may look for unknown senders, senders with identities that are similar to but not identical to previous senders or to known contacts, or senders that were added only recently as contacts. Links embedded in messages may be checked by comparing them to links previously received or to domain names of known contacts. The system may flag messages as potential threats if they contradict previous messages, or if they appear unusual compared to the patterns of previous messages.

Abstract: Among other things, from content of a communication composed by a user, a strategy is inferred for selecting target information related to the content. The strategy is used to select target information from a body of target information. And information about the selected target information is reported to the user.

Abstract: A system that transforms electronic messages into annotated messages that include contextual information to aid a recipient in utilizing the electronic message, understanding its meaning, and responding to the message. Annotations are additions or modifications to the original message with contextual information that is related to the features and contents of the original message. Message features are extracted and used to search one or more sources of contextual information. Relevant items are retrieved and added to the message, for example as attachments, hyperlinks, or inline notes. Machine learning techniques may be used to generate or refine modules for feature extraction and information selection. Feedback components may be used to track the usage and value of annotations, in order to iteratively improve the annotation system.

Abstract: A malware detection system based on stored data that analyzes an electronic message for threats by comparing it to previously received messages in a message archive or to a contacts list. Threat protection rules may be generated dynamically based on the message and contacts history. A message that appears suspicious may be blocked, or the system may insert warnings to the receiver not to provide personal information without verifying the message. Threat checks may look for unknown senders, senders with identities that are similar to but not identical to previous senders or to known contacts, or senders that were added only recently as contacts. Links embedded in messages may be checked by comparing them to links previously received or to domain names of known contacts. The system may flag messages as potential threats if they contradict previous messages, or if they appear unusual compared to the patterns of previous messages.

Abstract: A system that transforms electronic messages into annotated messages that include contextual information to aid a recipient in utilizing the electronic message, understanding its meaning, and responding to the message. Annotations are additions or modifications to the original message with contextual information that is related to the features and contents of the original message. Message features are extracted and used to search one or more sources of contextual information. Relevant items are retrieved and added to the message, for example as attachments, hyperlinks, or inline notes. Machine learning techniques may be used to generate or refine modules for feature extraction and information selection. Feedback components may be used to track the usage and value of annotations, in order to iteratively improve the annotation system.

Abstract: An electronic message threat protection system that incorporates user authorization to ensure that only authorized users receive the benefits of the system's protection. The system protects against threats such as phishing attacks or malware embedded in attached files. References to resources in messages, such as links or attachments, are transformed into protected references that may for example insert a level of indirection between the user and the resource. Use of a protected reference triggers a user authorization check; if the user is an authorized user, the system provides access via a security mechanism that mitigates potential threats. Unauthorized users are denied access. A message recipient may deliberately or inadvertently distribute copies of the message or of the protected references; however, the authorization check ensures that recipients of the copies can only access resources via these copies if they are authorized users.

Abstract: The technology described in this document can be embodied in a method that includes receiving information via a user interface provided on a display of a user device from a first user associated with a pre-determined user group. The information includes an identification of a) a source language and b) a target language to which translation from the source language is requested. The method also includes determining that one or more second users of the pre-determined user group is associated with the source language and associated with the target language. This can be determined based on accessing a data repository that stores language capabilities of users within the pre-determined user group, wherein the language capabilities are determined automatically based on mining a corpus of electronic documents associated with the pre-determined user group. An identification of the one or more second users can be displayed on the user interface.

Abstract: Among other things, we describe identifying, in first data available to a first user and not available to a second user, and in second data available to the second user not available to the first user, data pertaining to a common topic, and enabling the first user and the second user to communicate about the common topic based on the identification.

Abstract: Among other things, we describe identifying, in first data available to a first user and not available to a second user, and in second data available to the second user not available to the first user, data pertaining to a common topic, and enabling the first user and the second user to communicate about the common topic based on the identification.

Abstract: Among other things, at a client computer system in communication with a computer network, a request object is generated that includes logic to control the handling of requests. At least one of the requests depends on (for example, simply by being part of a sequence) a result of at least one of the other of the requests. The request object is sent to a server computer system that is in communication with the computer network. A response object is received that includes results of at least some of the requests.

Abstract: Among other things, from content of a communication composed by a user, a strategy is inferred for selecting target information related to the content. The strategy is used to select target information from a body of target information. And information about the selected target information is reported to the user.

Abstract: Among other things, from content of a communication composed by a user, a strategy is inferred for selecting target information related to the content. The strategy is used to select target information from a body of target information. And information about the selected target information is reported to the user.