Every attack is a stack. We switch off all of it.
Removing a phishing page is the easy part. The page sits on a host, under a domain, behind a DNS zone and a certificate, and is reached through lures and redirectors. The stolen data goes somewhere. Each layer has an owner who can act, and each owner needs a different report.
The layers
The layers of an attack, and who can switch each one off
Lures
E-mail, SMS and messaging-app messages that bring victims in.
Who can switch it offMail, SMS and messaging providers
Redirectors and short links
Hops that hide the real destination and dodge filters.
Who can switch it offLink and redirect services
Landing pages and kits
The fake page and the code that runs it.
Who can switch it offHosting and cloud providers
Domain names
The names victims see, often registered in batches.
Who can switch it offRegistrars and registries
DNS
The name servers that keep a name working.
Who can switch it offAuthoritative DNS providers
TLS certificates
The padlock that makes a fake page look safe.
Who can switch it offCertificate authorities
Collection points
Where stolen data goes: panels, bots and data stores.
Who can switch it offThe hosts of those services and the messaging platforms they use
Tools and marketplaces
The kits and services that attackers buy or rent.
Who can switch it offThe platforms that host the sale
Browsers and security vendors
The blocklists that protect users while takedowns are still running.
Who can switch it offBlocklist and reputation services (they protect, rather than remove)
Worked example (placeholder names)
From one reported link to the whole operation
A customer forwards a link to https://lure.example/abc. That one URL is only the entrance. A careful investigation often shows more behind it:
- a redirector chain that ends at
landing.example - the hosting or cloud account that serves the page
- the registrar account that registered
landing.example, and sibling names registered in the same batch - DNS providers that may keep a name working after the registry has suspended it
- a certificate issued days before the attack began
- a script that names the collection point the stolen data is sent to
Each of these becomes its own report, to its own recipient, with its own evidence. Taking down only the first one leaves the rest ready for the next campaign.
Blocking is not takedown
We do both, because they do different jobs.
Blocking protects users
Blocklists warn visitors while a page is still online. They do not remove it, and they do not touch the infrastructure behind it.
Takedown removes the attack
Takedown removes the page and shuts down the names and accounts behind it. We ask security vendors to block while the takedown runs, so that your customers are protected in the meantime.
Let us show you how deep we go.
Request a briefing and we will walk you through the service, the process, and how it would apply to your brands.