DNS Defense 
DNS Defense Cloud 
IP Defense 
ThreatSTOP for AWS 
Keep serving legitimate customers in Ukraine. Stay on the right side of sanctions.
TopCashback, one of the biggest cashback brands in the world, needed to keep traffic from sanctioned regions off its sites without turning away members and partners in the rest of Ukraine. ThreatSTOP's managed OFAC rules for AWS WAF took that job off its plate.
Sanctions that change faster than an IT team can track.
TopCashback has to make sure it does not accept online traffic from sanctioned regions. After Russia invaded Ukraine, the sanctions that followed made that harder: parts of Ukraine, such as Crimea, came under sanctions, while TopCashback still needed to support its business partners and customers everywhere else in the country. Keeping up with internal resources alone would have been difficult, if not impossible.
An outsourced answer to OFAC obligations.
TopCashback attached ThreatSTOP's Enhanced OFAC managed rules to its AWS Web Application Firewall. The rules block sanctioned countries, entities and subsidiaries, and ThreatSTOP keeps them current as sanctions change.
Who TopCashback is
TopCashback was founded in the UK in 2005 by Olly and Mike, starting from a literal dining room table. It is now one of the biggest cashback brands in the world, with sites in the UK, France, the US, Germany, China, Australia, Spain and Italy. Thousands of brands pay TopCashback when its members shop with them, and TopCashback shares that money with members as cashback.
Andy Bayes, TopCashback's CIO, explains what the company needed and why it chose ThreatSTOP.
The challenge
"In an increasingly complex and fast changing sanctions landscape, we wanted to find a reliable outsourced resolution to our OFAC (Office of Foreign Assets Control) sanctions obligations," says Andy. "Namely, we needed to ensure that we do not accept online traffic from sanctioned regions."
The Russian invasion of Ukraine, and the raft of sanctions that followed, made the problem sharper. Certain parts of Ukraine were under sanctions, such as Crimea, but TopCashback needed to keep supporting its partners and customers in the rest of the country. With the geopolitical picture changing quickly, the team decided it was better to outsource the expertise.
Finding ThreatSTOP
The team was searching online for a way to block the sanctioned parts of Ukraine without blocking the country as a whole. That search led to ThreatSTOP, which was referenced in the AWS Marketplace and on ThreatSTOP's own website.
Why TopCashback chose ThreatSTOP
- ThreatSTOP replied promptly to questions and was willing to demo the solution and then run a trial.
- TopCashback's contacts at AWS gave positive feedback on it.
- A lot of work and knowledge goes into deciding what to block, which gives a more accurate answer on which IPs should be blocked and which should not.
- Building a similar rule set in house from country and region codes would have been a lot of work, and it would have needed constant maintenance. ThreatSTOP was more scalable than anything the team could have built in house.
How it works
TopCashback serves its sites through Amazon CloudFront on AWS. ThreatSTOP's Enhanced OFAC managed rules attach to its AWS WAF, which sits in front of CloudFront, so traffic from sanctioned regions and entities is stopped before it reaches the sites.
The simplicity of integrating ThreatSTOP with our AWS WAF and the support they provided when we required further support and questions won us over.
The result
"They came across as very knowledgeable and helpful in this area," says Andy. Support came through a mix of ThreatSTOP's support portal, direct emails and calls when needed. His advice to others looking for something similar: "We would recommend ThreatSTOP because we have been very pleased with the product and their support."
What TopCashback gets.
Keep sanctioned traffic off your sites.
Attach ThreatSTOP's managed OFAC rules to the AWS WAF you already run. Request a trial, or talk to an engineer.