Phishing and malware takedown by TwoFive
Take down the whole attack, not just the URL.
Unlimited takedowns for one monthly fee. When your brand is attacked, we go deep: every domain, host, redirector, DNS zone, certificate and sender behind the attack, reported to every party that can switch it off.
- Unlimited takedowns
- One monthly fee
- The whole infrastructure
- Intelligence that feeds detection
The problem
Takedown by the URL is a treadmill.
Attackers register domains in batches and abandon them within days. A service that removes one URL at a time, and bills for each one, leaves everything behind the URL untouched: the hosting account, the redirectors, the name servers, the senders, the kit itself. The next URL appears, and the meter keeps running.
You pay more the harder you are hit
Per-takedown pricing makes your costs follow the attackers' effort instead of your protection. A big campaign becomes a big invoice.
Domains are disposable. Infrastructure is not.
Registering another domain is cheap for an attacker. The accounts, servers and tools behind it are what they need to keep going, so that is where we aim.
Takedowns that stop at the URL come back.
If only the page is removed, the same kit reappears on the next name. We map the whole operation, report all of it, and keep watching it.
Why Konzetsu
One fee. Every layer. Real intelligence.
We built the service around the way attacks really work: layered, repeated and reused.
Unlimited takedowns, one monthly fee
No meter running per URL and no surprise invoice after a big campaign. You get a predictable budget however hard you are hit.
We go deep, not just wide
Every attack has layers. We find them all and report each one to the party that can act: the host, the registrar and registry, the DNS provider, the certificate authority, the link service, the sender, the blocklist maintainers.
Investigation, not just reporting
We read the attacker's code as text, map the infrastructure behind it, look for sibling domains and servers, and attach evidence that abuse desks can act on quickly.
What we learn protects you next time
Every investigation produces fingerprints and indicators. They feed our detection systems so that adjacent infrastructure can be found and taken down, potentially before it is ever used in an attack.
Stay-down monitoring
We keep watching the whole infrastructure and report again if it comes back.
Evidence you can rely on
Captures are stored unchanged with cryptographic hashes, so every report and every later review rests on the same facts.
Outreach in the languages providers use
Reports are written for each recipient, in a language and format their abuse desk works in.
Escalation when providers do not act
We follow up on every report and move to the next channel when a provider stays silent.
Clear status for every case
What was reported, to whom, when, and what happened. No guessing.
Built by messaging-security specialists
TwoFive has worked on e-mail and messaging security since 2014.
Whole-stack takedown
An attack is a stack. We switch off all of it.
Removing a phishing page is the easy part. Each layer behind it has an owner who can act, and each owner needs a different report.
Lures
Who can act: Mail, SMS and messaging providers
Redirectors and short links
Who can act: Link and redirect services
Landing pages and kits
Who can act: Hosting and cloud providers
Domain names
Who can act: Registrars and registries
DNS
Who can act: Authoritative DNS providers
TLS certificates
Who can act: Certificate authorities
Collection points
Who can act: The hosts of those services and the messaging platforms they use
Tools and marketplaces
Who can act: The platforms that host the sale
Browsers and security vendors
Who can act: Blocklist and reputation services (they protect, rather than remove)
How it works
Five steps, from the first report to the last copy.
Detect
Reports reach us from your channels and from our monitoring of attacks on your brands.
Investigate and map
We capture the evidence and map every domain, host, redirector and account behind the attack.
Report to everyone at once
Each responsible party gets a report written for them, in parallel.
Escalate and verify
We follow up, escalate, and check that the content is really gone.
Stay down and learn
We keep watching, and feed what we learn back into detection.
Intelligence loop
Every takedown makes the next one faster.
A service that only reacts is always one step behind. We turn every case into knowledge, and put that knowledge to work.
Investigate
Each case is taken apart: the kit, the hosting, the registrations, the certificates.
Fingerprint
We record what is distinctive: script names, page structure, routes, habits of the infrastructure.
Hunt and detect
Fingerprints and indicators feed our detection systems to find siblings and copies.
Pre-empt
New infrastructure that matches a known pattern can be reported before it carries an attack.
Every new find starts the loop again.
Who it is for
Built for organisations whose customers get phished.
If attackers use your name, your customers pay the price, and so does your reputation.
- Banks and card issuers
- Payment and fintech companies
- E-commerce and marketplaces
- Telecom and mobile carriers
- Public sector and government
- Brand owners
- Security service providers (MSSPs)
Pricing
One monthly fee. Unlimited takedowns.
Tell us which brands and regions you want covered and what you see today. We will propose a plan with a flat monthly fee. There is no charge per URL, per domain or per takedown.
- No charge per URL, domain or takedown
- Whole-infrastructure takedown, not only the page
- A budget your finance team can plan for
Common good
Some of what we learn belongs to everyone.
We believe that stopping an attack once should make it harder to repeat against everyone. Where it is lawful and appropriate, we share what we learn with the organisations that protect the wider internet.
About TwoFive
Messaging security is what we do.
TwoFive, Inc. is a Japan-based messaging, messaging-security and threat-intelligence company founded in 2014 and headquartered in Tokyo. We have been a member of M3AAWG since 2015, we are a founding member of JPAAWG, and we are active in the Council of Anti-Phishing Japan.
Let us show you how deep we go.
Request a briefing and we will walk you through the service, the process, and how it would apply to your brands.