Abstract: This disclosure discusses methods, systems, and an apparatus that can determine whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content. The disclosure discusses some embodiments that include evaluating text in the email content to determine if predetermined suspected malicious phrases are present in the text, evaluating one or more links in the email content using an IP address, URL, or DNS to determine if the links reference potentially malicious web content, and evaluating metadata in the email content to determine if the email content is potentially malicious.

Abstract: A method and system for discovering inappropriate and/or illegitimate use of Web page content, comprising: monitoring access to a first Web page by a user; comparing information from the first Web page to information from a second known legitimate Web page; and determining whether the first Web page is legitimate based on the compared information.

Abstract: This disclosure discusses methods, systems, and an apparatus that can determine whether email content is potentially malicious, contains potentially malicious content, has originated from a potentially malicious entity, or contains links or other references to potentially malicious web content. The disclosure discusses some embodiments that include evaluating text in the email content to determine if predetermined suspected malicious phrases are present in the text, evaluating one or more links in the email content using an IP address, URL, or DNS to determine if the links reference potentially malicious web content, and evaluating metadata in the email content to determine if the email content is potentially malicious.

Abstract: A method and system for discovering inappropriate and/or illegitimate use of Web page content, comprising: monitoring access to a first Web page by a user; comparing information from the first Web page to information from a second known legitimate Web page; and determining whether the first Web page is legitimate based on the compared information.

Abstract: A method and system for discovering inappropriate and/or illegitimate use of Web page content, comprising: monitoring access to a first Web page by a user; comparing information from the first Web page to information from a second known legitimate Web page; and determining whether the first Web page is legitimate based on the compared information.

Abstract: A system and method for proactively discovering DNS resolvers in a network, comprising: sending IP addresses in the network to a scanning application; directing the scanning application to query each computer that corresponds to each IP address for information indicating whether each computer is a DNS resolver or a non DNS resolver; and identifying each computer as a DNS resolver or a non DNS resolver based on the information.

Abstract: A method and system for discovering inappropriate and/or illegitimate use of Web page content, comprising: monitoring access to a first Web page by a user; comparing information from the first Web page to information from a second known legitimate Web page; and determining whether the first Web page is legitimate based on the compared information.