At ThreatSTOP, proactive protection isn’t just a buzzword—it’s core to how we safeguard our customers’ digital environments. A prime example of this approach is our “Feedback Loop” process, a dynamic and intelligent method employed by our Security, Intelligence, and Research team to ensure continuous, evolving protections against emerging threats.

Take the recent example involving IP address 173.0.146.175. Back in February, our telemetry identified phishing domains beginning to emerge on this IP. Rather than simply waiting for widespread malicious activity, our analysts proactively convicted this IP, immediately extending protection across our entire customer base. This preemptive action exemplifies how the ThreatSTOP Feedback Loop effectively anticipates threats before they fully materialize.

Initially, traffic to this IP remained low, suggesting cautious attacker behavior—possibly testing or staging future campaigns. However, our early conviction meant ThreatSTOP customers were already protected. Fast forward three months to May 15: our telemetry suddenly recorded a sudden increase in traffic to this IP. In just four days, 165 different domains emerged, most of them clearly associated with widespread phishing campaigns aimed at deceiving users into compromising sensitive information.  The IP belongs to servers.com, a shared hosting provider.

173.0.146.175

While a couple of legitimate domains were observed, our proactive measures ensured minimal false positives and maximum protection. This ability to anticipate, analyze, and neutralize threats well before they become widespread attacks demonstrates the power of ThreatSTOP’s Protective DNS (DNS Defense Cloud and DNS Defense) and IP Defense solutions.

ThreatSTOP’s proprietary feedback loop continuously leverages real-world data, refining protections against phishing, command and control, data exfiltration, spam, invalid traffic, peer-to-peer communication, and Distributed Denial of Service (DDoS) activities. Our Security, Intelligence, and Research team tirelessly monitors, assesses, and updates these protections, ensuring your digital environments remain secure against evolving threats.

Aligning Our Feedback Loop Protection with the MITRE ATT&CK Framework:

 

MITRE ATT&CK Technique

Application in ThreatSTOP Feedback Loop

Initial Access (Phishing)

Early detection and proactive blocking of phishing domains

Command and Control

Preemptive blocking of IPs and domains involved in malicious command and control

Exfiltration

Detection and prevention of domains/IPs potentially used for data exfiltration

Reconnaissance

Early-stage identification of malicious infrastructure setup

 

For those interested in joining the ThreatSTOP family or learning more about our proactive protections for all environments, we invite you to visit our product page. Discover how our solutions can significantly strengthen your digital security posture. We offer pricing suitable for organizations of all sizes. Get started with a Demo today!

Connect with Customers, Disconnect from Risks.