The Battle for a Safer Internet: Inside Domain Takedowns and Threat Actor Tactics

Collaborative Efforts: How teams work together to identify scam websites, gather evidence, and escalate for takedown.

Tools and Techniques: Using tools like domain search, backend kits identification, and IP-based connections to uncover related sites.

Challenges in Takedowns: Managing lists of hundreds of domains across multiple providers, verifying live activity, and the need for ongoing monitoring.

Threat Actor Behavior: How threat actors use multiple registrars or re-register domains to evade detection.

Best Practices for Organizations:

Preemptively purchasing lookalike domains.
Monitoring new domain registrations for suspicious activity.
Educating users to identify and avoid malicious domains.

Ethical Considerations: Balancing infrastructure disruption with the need for ongoing research, particularly for cyber espionage threats.

Favorite Wins: Memorable investigations, such as takedowns during the Super Bowl, fake Olympics ticket scams, and real-time disruption of pig-butchering schemes.