Netcraft launched its phishing feed in 2005, the first of its malicious site feeds. Combining sophisticated phishing attack discovery and classification methods with reporting from Netcraft’s global anti-cybercrime community, Netcraft’s phishing site feed quickly became an industry standard source for anti-phishing.
Along with URLs reported by the community, Netcraft collates and validates reports from many of the world’s largest banks, threat intelligence providers, and anti-cybercrime organisations. Netcraft also recovers URLs from ongoing analysis of malicious email attachments, many of which serve as key infrastructure in malware operations.
The malicious site feeds are provided by classifying millions of URLs each day according to the various attack types. This stream of malicious sites is available as a collection of continuously updated feeds, suitable for security engineers, network administrators, and internet service providers.
Netcraft’s feeds can be used to prevent customers and employees from falling victim to phishing, malware attacks and fake shops. It presents an excellent opportunity for businesses to win new customers and reassure existing ones by taking a proactive stance against fraud.
Phishing sites are designed to trick visitors into submitting private information by posing as a trusted or legitimate entity. Netcraft’s phishing site feed is used by all major web browsers to protect their users, and is also licensed by many of the leading anti-virus, content filtering, web-hosting and domain registration companies.
Fake shops claim to offer highly discounted luxury goods, typically for premium clothing, shoe or electronics brands. However, in reality they are simply a front to capture users’ payment information: after the victim completes the checkout process, they will be delivered counterfeit products, or possibly even no products at all. Netcraft blocks over 1,000 fake shops every day.
Fake pharmacies claim to sell pharmaceuticals but have none of the licencing required by the jurisdictions in which they offer products. While many fake pharmacy sites will actually deliver to victims, the drugs delivered are likely to be incorrect, substandard, or counterfeit.
Shopping Site Skimmers
Technical Support Scams
Fraudsters make use of scam websites purporting to be legitimate technical support sites to trick visitors into actions such as installing malware, making financial transfers, using premium rate services or allowing remote access to their machines.
Investment scams encourage victims to transfer funds to the fraudster on the promise of large returns, often impersonating well-known public figures (such as Sir Richard Branson) to promote the scheme. These scams are among the highest volume attacks seen by Netcraft.
Web shells are backdoor control panels that allow total control over a compromised web server, letting fraudsters easily steal data from the server, launch phishing attacks, join the server to a botnet, engage in DDoS attacks, and distribute malware, to name a few. The web shell feed provides a list of web shells and the associated compromised sites.
Malware Infrastructure URLs
Netcraft processes millions of spam emails every day, and any malware attachments are analysed to identify key infrastructure URLs. Running the malware in a sandbox environment reveals the URLs that it attempts to connect to, including those that transmit operational instructions for the malware, download further stages of the attack, or receive payment for malware such as ransomware.
Malicious email addresses
Netcraft can also provide a feed of email addresses participating in advance fee fraud schemes, found in the millions of spam emails that it analyses. This feed also contains any addresses intended to receive credentials captured by the phishing attacks that Netcraft identifies.
Non-consensual cryptocurrency miners
The malicious site feeds make up a constantly updated database of patterns that match the URLs and email addresses recorded by Netcraft.
The feeds are available as either an encrypted database, with which specific identifiers can be looked up to determine whether they’re blocked; or a plain text database, letting you view the full contents of the feed, and offering extra information about the threats such as attack targets and IP addresses.
The feeds employ a versioning system to ensure that customers who have fallen behind can catch up incrementally, or if necessary, by requesting the full feed.
We also regularly re-test malicious URLs so that they can be removed from the feed once the malicious content has been taken down. This ensures that end users of the feeds are not prevented from accessing any legitimate content on a previously compromised site for longer than is necessary.
Reference code and technical documentation is provided to help integrate the feeds into your products and services, and support is available via email and telephone.