(19)Fresh off Patent
(45) Week of Oct 19, 2026 No. 7 3,667 lapsed 70 listed
Cybersecurity & privacy · lapsed Sep 4, 2026

Link display vs target similarity check to flag fraudulent links

A method that compares hyperlink display text and the underlying destination address, computes a character-overlap similarity ratio, and flags the link as fraudulent when the ratio exceeds a threshold indicating a dishonest transformation. It classifies and triggers actions (block, warn, log) when display text appears to mimic a different legitimate domain. Email clients, web gateways and browser security extensions are the likely users.

Sheet 1 of the patent drawingsSheet 2 of the patent drawingsSheet 3 of the patent drawings

(57) What the patent covered

This write-up was generated by AI from the patent's text and may contain mistakes, so check it against the original patent before relying on it.

The main independent claim requires receiving a hyperlink, computing a similarity value equal to the ratio of characters common between the destination address and the display text divided by the total number of characters of one of them, determining the display text is a dishonest transformation when that similarity exceeds a predetermined threshold, classifying the destination as fraudulent on that condition, and taking an appropriate action.

Distinguishing feature: Using a simple character-overlap ratio between display text and destination address as the decision metric for ‘dishonest transformation’.

Novelty 3/5. At filing (2004) link-checking and domain-blacklists were common; the patent added a specific character-overlap ratio test rather than full lexical or visual-similarity algorithms.

Implementation

A small team would parse incoming documents (HTML/email) to extract hyperlinks, normalize display text and href (strip protocols, punycode decode, case-normalize), compute the overlap ratio = common character count ÷ total characters (choose display or target per spec), compare to a configured threshold, consult a domain whitelist/blacklist, and then emit policy actions via the client UI or gateway logs/blocks. Implement as a service in 1–2 engineers (2–6 weeks) using existing HTML parsers and a rules engine.

Components: HTML/email parser to extract display text and href target, String-similarity comparator (character overlap ratio), Domain name database or whitelist/blacklist, Policy engine to classify and trigger actions (block, warn, log).

Buildability 5/5. Implementation is straightforward; main tuning items are threshold selection, normalization (punycode, Unicode homoglyphs) and integration into mail clients or proxies.

Market demand

No demand check has been run for this patent. Likely search terms: display text vs href similarity check, hyperlink spoof detection, fake link detection email gateway. The links in the sidebar open these searches.

Buyers: Email providers, web gateways, browser security vendors.

Before manufacturing

This patent has 1 related US patent (continuation, divisional or parent) that may remain in force: US 10,693,910. Review their claims before proceeding.

Patent lapsed; practical risks are false positives from legitimate intentional display-target mismatches and the need to handle Unicode/punycode homoglyphs and internationalized domains.

About 1.5% of lapsed patents are later revived by their owners. This page is a research lead, not legal advice. Obtain a freedom-to-operate opinion before manufacturing.

Claim 1, as granted

1. A computer-implemented method of processing a destination address, the method comprising: receiving, within memory a computer hardware device, the destination address of a hyperlink; comparing the destination address of the hyperlink with display text of the hyperlink to determine that the display text of the hyperlink is a dishonest transformation of the destination address of the hyperlink by computing by the hardware device a ratio of a number of characters common between the destination address of the hyperlink in the memory and the display text of the hyperlink, and a total number of characters of either the destination address or the display text, setting a similarity value for the destination address of the hyperlink and the display text of the hyperlink as the computed ratio, and determining that the display text of the hyperlink is a dishonest transformation of the destination address if the similarity value between the destination address of the hyperlink and the display text of the hyperlink exceeds a predetermined value; classifying the destination address of the hyperlink as a fraudulent address on condition that it is determined that the display text of the hyperlink is a dishonest transformation of the destination address because the computed similarity value exceeds the predetermined value; and taking an appropriate action in the computer hardware device in response to classifying the destination address of the hyperlink as a fraudulent address.