Faster Than a Takedown: How Collective Internet Defense Disrupts Attacks at Scale
Most of us measure success one host at a time: find a malicious domain, file an abuse report, and wait days to weeks (or months) for a single domain to come down. That is a takedown. It is an essential part of mitigation, but it is slow, buying the attacker time to re-host the moment it works. Underneath it runs a faster layer most defenders never learn exists: an ecosystem of collective defense made of the internet's core infrastructure operators, such as browser and OS blocklists, public resolvers, mail reputation, and verdict aggregators, that can revoke an attacker's reach in minutes, sometimes faster than DNS propagation. I did not appreciate how much reach this layer has until I pulled the operators' own numbers. In this session I show how disruption and takedown work as two complementary layers, trace how one reported verdict propagates across the fabric of the internet, ground it in public documented cases, and show you how to tap in: point your resolvers at a public option, ingest open feeds, and report your own indicators to the community platforms built for it.
Takedown removes content permanently, but slowly, and it stalls behind bulletproof hosting, uncooperative registrars, and trademark processes that require legal intervention and run for months. Disruption is the faster layer: it stops internet traffic from reaching malicious infrastructure, often in minutes, and it can be the only protection a defender has while a takedown grinds on. This is not a talk about submitting a better takedown request. It is about the layer running underneath it: who operates it, how an IOC verdict moves through it, and how you can plug in.
What the talk covers:
- One attack, two mitigations. The picture most teams carry (one report, one host, one takedown, measured in days / weeks / months, reversed if the attacker re-hosts) versus the faster response through the internet's infrastructure.
- The invisible infrastructure of collective defense, told through the operators' own published reach. Browser and OS blocklists (Google Safe Browsing, which warns billions of users and devices), public resolvers (Quad9, a nonprofit backed by the Global Cyber Alliance, blocking hundreds of millions of malicious lookups a day across more than 130 countries from more than twenty independent threat intelligence sources), mail reputation (Spamhaus, screening billions of mailboxes before a message lands), verdict aggregators (VirusTotal), and the endpoint engines that carry those verdicts. For on-prem and air-gapped networks, response policy zone feeds let any organization act on the same verdicts inside its own resolvers.
- Disruption and takedown, side by side. Speed, permanence, coverage, and requirements for each, when takedown is not available, and the resurgence problem when a domain taken down resurges in 30 to 60 days.
- How a verdict propagates. A trusted contributor reports a verdict, partners accept it, and the threat stops resolving across browsers, resolvers, inboxes, and endpoints at once. What governs speed and breadth, and the honest limit: coverage is the union of partner networks, not the whole internet.
- What it is worth, and the new KPIs. Public documented cases: standing community disruption (URLhaus), the consensus blocklists that protected healthcare during the pandemic, and a published case in which a single predicted domain reported to a public resolver blocked more than 365 million malicious hits in 30 days. The KPIs that prove it: hits prevented, mail blocked, devices warned, and victims averted, rather than domains removed.
- The disruptive defender's playbook. Point your resolvers at a public option such as Quad9, ingest open feeds like Spamhaus and response policy zones, and report your own indicators to community platforms built for public submission such as URLhaus. Said honestly: becoming a trusted partner to a major browser or resolver takes partner interest, extensive validation, and integration work, and in some cases is limited to dedicated cyber defense providers rather than commercial companies, so I do not sell it as a first step.
- Demo. I close with an anonymized real case: real timestamps and verdicts with every identifying detail replaced by placeholders, each partner's status shown through that partner's own public-facing verdict, and a victims-averted figure shown next to Quad9's own published aggregate statistics for public context.
- Q&A
Andre Piazza is a cybersecurity strategist at BforeAI who works left of boom, catching adversary infrastructure during its staging window, before ransomware, account fraud, or brand and supplier impersonation reaches a target. He treats attacks as infrastructure and behavior rather than content, working from public signals like WHOIS, DNS, certificate transparency, and ASN data, and linking domains by registration velocity, shared certificate fingerprints, and hosting overlap to surface lookalike and impersonation infrastructure before it goes live. His work spans verification fraud, impersonation built with AI, scams that spin up around breaking news, and operational technology, and it gives as much weight to the human trust attackers exploit as to the technology. He turns published threat research into methods practitioners can use the next day, and he is a regular speaker at the SANS AI Cybersecurity Summit, BSides conferences including Seattle, Hou.Sec.Con, and Cybr.Hak.Con. He cares about building a more resilient community through collective defense.