Every investigation makes the next takedown faster.
A service that only reacts is always one step behind. We turn every case into knowledge and put that knowledge to work, so that adjacent infrastructure can be found and taken down, potentially before it is used in an attack.
The loop
Four stations, one loop
Takedown is where the loop starts, not where it ends.
Investigate
Each case is taken apart: the kit, the hosting, the registrations, the certificates.
Fingerprint
We record what is distinctive: script names, page structure, routes, habits of the infrastructure.
Hunt and detect
Fingerprints and indicators feed our detection systems to find siblings and copies.
Pre-empt
New infrastructure that matches a known pattern can be reported before it carries an attack.
Every new find starts the loop again.
What we learn
Three kinds of knowledge from every case
Fingerprints of the kit
Names of scripts, page structure, routes, and the way a kit behaves. These stay the same when the domain changes.
Habits of the infrastructure
Hosting networks, registrars, registration patterns and certificate timing that an operator keeps repeating.
Indicators
Domains, addresses, certificates and file hashes that can be matched in detection systems.
What we do with it
Knowledge only helps when it is used.
Hunt for siblings
We search for other copies of the same kit and other domains in the same pattern, and report them too.
Feed detection
Fingerprints and indicators go into our detection systems and, with your agreement, into yours.
Pre-empt
When a known pattern shows up in new registrations or certificates, we can act before the first lure is sent.
What to expect
An honest note on limits
Pre-emption works when attackers repeat themselves, which they often do. It is not magic. Some campaigns give no early signal, and we will tell you which signals have proved useful on your brands.
Common good
Some of what we learn belongs to everyone.
Part of what we learn is useful far beyond one customer. Where it is lawful and appropriate, we share indicators with the organisations that protect the wider internet, so that an attack stopped once is harder to repeat against everyone.
Let us show you how deep we go.
Request a briefing and we will walk you through the service, the process, and how it would apply to your brands.