Once you have been alerted to the fact that your company is the subject of an attack, the race is on to close the target malicious site as quickly as possible. However, professional fraudsters will take steps to ensure that the process is as difficult and time consuming as possible: your time is their money.

Netcraft currently performs takedowns for four of the ten most phished companies on the internet and in aggregate against around 30% of all phishing attacks, running at around one takedown group every fifteen seconds. Over 120 different attack types are supported, including phishing sites, malware, fraudulent social media profiles and fake mobile apps.

Fraudsters will often host their sites in developing countries with limited law enforcement resources and incentivise the hosting company to keep the site running as long as it possibly can. Indeed, some unscrupulous hosting companies actually promote fraud hosting as a service.

Netcraft’s countermeasures service helps organisations to combat these techniques. Once a phishing site has been detected, Netcraft immediately responds with a set of actions which will significantly limit access to the site, and will ultimately cause the fraudulent content to be eliminated.

Netcraft’s approach to removing phishing sites is distinguished from other providers of takedown services through its ability to immediately block access to the site for users of a wide range of technologies.

Countermeasures

Netcraft Malicious Site Feeds

Netcraft’s malicious site feeds are licensed by leading browsers, anti-virus and content filtering products, firewall and network appliance vendors, mail providers, registrars, hosting companies and ISPs.

Consequently, once the phishing site has been accepted into the feed, access to the site will be blocked for the low billions of people downstream shortly afterwards, significantly reducing the effectiveness of the phishing site even before it has been removed.

Additionally, Netcraft will receive notification of phishing attacks through its community of reporters and industry feeds in advance of reports received by you directly, and thereby can reduce the lifetime of the phishing site.

Extensive Automation and Preparation

Netcraft’s countermeasures are extensively automated, with local language translations available for every country that has hosted more than six phishing sites in the last six months and an extensive database of contacts at hosting companies, DNS providers, registrars and ISPs set up such that effective countermeasures will be started within seconds of a report being verified.

Additionally, Netcraft continues to monitor a phishing URL after it becomes unavailable, and if it reappears, perhaps because the host is compromised and the fraudster is able to replace the phishing content after the site owner removes it, then the countermeasures are restarted.

Wide Variety of Attack Types

Over 90 different attack types can be selected in the countermeasures service to remove malicious content. Providing takedowns for many different attack types allows Netcraft to effectively identify the malicious content and communicate the action required to the relevant parties. Netcraft is able to automatically identify the attack types for many reported attacks, providing a rapid response for verified attacks.

The countermeasures service offers takedowns including but not limited to the following attack types:

• Phishing
• Malware
• Email accounts and mail servers
• Fraudulent social media profiles/pages/groups
• Fraudulent phone numbers
• Fake mobile apps
• Fake shops
• Brand infringement, including survey scams

Hosting Company and Registrar Interaction

Netcraft will identify, contact and liaise with the company responsible for hosting the fraudulent content. Netcraft enjoys excellent relations with the hosting community, and many of the world’s largest hosting companies and domain registrars are Netcraft customers.

Netcraft can exercise its existing relationships with these companies to provide a swift and smooth response to the detection of the site. If the hosting company is reputable, this may be sufficient to ensure a prompt end to the fraudulent activity.

Upstream Bandwidth Providers

Netcraft’s geographically-distributed performance collectors can trace multiple routes to the server hosting the fraudulent content. This allows the upstream bandwidth providers to be identified and notified. If the upstream connectivity providers perceive that their business may be damaged through being identified as providing connectivity for a fraud site or larger fraud hosting operation, they may black hole the individual site, or withdraw their services from the hosting location.

Local Law Enforcement Agency

Netcraft will identify, contact and liaise with the law enforcement agency in the hosting company’s local jurisdiction.

Netcraft also engages with hosting companies to preserve & retrieve any data files, logs or other information left by the fraudster. Information identifying affected customers is very useful in mitigating the impact of the attack, and minimising monetary loss.

Transparent Progress Reporting

The takedown process is easy to follow for clients, who can track progress by web, electronic mail or RSS feed. The availability of the phishing site is monitored and graphed and new attacks are notified via mail, SMS and optionally SMS-to-voice.

Complementary Services

Netcraft’s Fraud Detection service uses Netcraft’s extensive collection of DNS and web content to search for and pre-empt fraud and phishing attacks. Netcraft can additionally provide security testing for a company’s own website to search for vulnerabilities which may assist fraudsters, such as cross site scripting, and supply a range of reputation feeds to assist organisations’ authentication processes.

Bespoke Options Available

Additional bespoke cybercrime detection and disruption services are also available.