Malware & Blacklisting Scanner for Website
| Quttera Data Feed
The Quttera QFEED data feed is a service for customers who need to stay updated on malicious and dubious domains. It provides structured data on domains, URLs, and their security status. Quttera constantly scans the Web for malware, using globally distributed data centers to ensure complete coverage. Millions of URLs are scanned every month, and the entries in the data feed are constantly updated as malicious sites turn up and infections are removed.
The security status of listed domains falls into four categories:
Blacklisted:
Persistent malware or phishing sites.
Persistent malware or phishing sites.
Suspicious:
Sites with indicators of malicious activity, but no definitive signs.
Sites with indicators of malicious activity, but no definitive signs.
Malicious:
Sites currently hosting malware or other malicious activity. They may be just temporarily infected.
Sites currently hosting malware or other malicious activity. They may be just temporarily infected.
Suspicious:
Sites with abnormal characteristics but no actual indicators of illegitimate activity.
Sites with abnormal characteristics but no actual indicators of illegitimate activity.
The QFEED is supplied as a yearly subscription. Subscribers receive technical support and a service level agreement (SLA). To get a price quote or apply for a subscription, contact sales@quttera.com
The feed is valuable for several types of customers. Most of them fall into these four categories:
The feed is valuable for several types of customers. Most of them fall into these four categories:
- IT departments of corporations and SMBs.
- Firewall vendors and distributors.
- Domain registrars.
- Internet service providers (ISPs) and hosting providers.
Visual aids are often used to help audiences of informative and persuasive speeches understand the topic being presented. Visual aids can play a large role in how the audience understands and takes in information that is presented.
IT departments
QFEED helps business IT departments to set up a list of risky sites. If employees can freely open any link, they're vulnerable to attempts at deception. They could open a spoofed website and enter their login credentials. Some sites can infect desktop machines just by being opened. "Malvertising" and cross-site scripting can infiltrate even sites with good reputations. Blocking all material from known hostile sites is the best protection against them.
Depending on the severity of their status and the company's policies, the company's filters can block them completely or issue a warning when employees try to access them. Preventing inadvertent access to those sites will decrease the chances of infection through the browser.
The IT department can use the information in spam filters, rejecting or flagging all mail which comes from a malicious or blacklisted IP address. This will reduce the amount of phishing mail and other spam that gets to people's inboxes. They'll save time, and there will be less risk of opening harmful attachments or visiting dangerous websites.
QFEED doesn't list sites on the basis of inappropriate content, only risk. IT departments can take whatever measures are appropriate for allowing or blocking kinds of content.
The feed data is useful for security analytics. A large number of packets from a known malicious domain could indicate an attack in progress. Early detection of those attempts lets administrators take any necessary countermeasures.
Depending on the severity of their status and the company's policies, the company's filters can block them completely or issue a warning when employees try to access them. Preventing inadvertent access to those sites will decrease the chances of infection through the browser.
The IT department can use the information in spam filters, rejecting or flagging all mail which comes from a malicious or blacklisted IP address. This will reduce the amount of phishing mail and other spam that gets to people's inboxes. They'll save time, and there will be less risk of opening harmful attachments or visiting dangerous websites.
QFEED doesn't list sites on the basis of inappropriate content, only risk. IT departments can take whatever measures are appropriate for allowing or blocking kinds of content.
The feed data is useful for security analytics. A large number of packets from a known malicious domain could indicate an attack in progress. Early detection of those attempts lets administrators take any necessary countermeasures.
Firewall vendors and distributors
A firewall's functions include blocking known malicious domains and IP addresses. This information is constantly changing. Criminals can acquire previously legitimate domains. Other sites get cleaned up and become safe again. The best firewalls maintain a list of untrusted domains and regularly get updates for it.
Malicious packets and DDoS attacks often come from sites which are known to be dangerous. Disallowing packets from blacklisted or malicious sites reduces the number of attempts that get through.
Packet blocking should cover both incoming and outgoing traffic. Outgoing packets to a malicious domain can be the result of mistakes or malware. People may access a dangerous website through a browser. Content from a malicious site can infiltrate otherwise safe pages. In addition, malware tries to contact command and control servers, downloading additional software or sending stolen data.
An up-to-date list of sites to block, downloaded to each installed firewall at regular intervals, keeps it effective at stopping dangerous traffic.
Malicious packets and DDoS attacks often come from sites which are known to be dangerous. Disallowing packets from blacklisted or malicious sites reduces the number of attempts that get through.
Packet blocking should cover both incoming and outgoing traffic. Outgoing packets to a malicious domain can be the result of mistakes or malware. People may access a dangerous website through a browser. Content from a malicious site can infiltrate otherwise safe pages. In addition, malware tries to contact command and control servers, downloading additional software or sending stolen data.
An up-to-date list of sites to block, downloaded to each installed firewall at regular intervals, keeps it effective at stopping dangerous traffic.
Domain registrars
A domain registrar should keep track of which customers are flagged as untrustworthy. Ignoring them will drive the registrar's reputation downhill before long. At the same time, it shouldn't assume the customer is doing nefarious things simply because it's on the list.
The first step is to notify the customer. It could be listed because of content which was already found and removed. The malicious content could be from one of the customer's users or from a drive-by file upload. In many cases, the customer will be able to identify and correct the problem.
Some customers really set up domains for malicious purposes, and catching them is important. If a customer doesn't respond, or if the problem persists, the registrar has to take additional steps. The domain's listing in QFEED is one indicator, but registrars need to do their own investigation.
Whenever it's possible, the registrar should work with the customer. The notification that it's listed in QFEED may be the first indication the customer has that anything is wrong. Some customers, though, just let their domains run and don't do any maintenance. In the case of persistent problems, suspending their domain may be the only thing that gets their attention.
The first step is to notify the customer. It could be listed because of content which was already found and removed. The malicious content could be from one of the customer's users or from a drive-by file upload. In many cases, the customer will be able to identify and correct the problem.
Some customers really set up domains for malicious purposes, and catching them is important. If a customer doesn't respond, or if the problem persists, the registrar has to take additional steps. The domain's listing in QFEED is one indicator, but registrars need to do their own investigation.
Whenever it's possible, the registrar should work with the customer. The notification that it's listed in QFEED may be the first indication the customer has that anything is wrong. Some customers, though, just let their domains run and don't do any maintenance. In the case of persistent problems, suspending their domain may be the only thing that gets their attention.
Internet service providers
ISPs and hosting providers are in a situation similar to domain registrars, but they have more ways to identify problems. By the same token, an ISP's reputation will suffer even more than a registrar's if it doesn't deal with dangerous content.
The basic situation is similar: if customer sites are flagged, the provider needs to make sure the customer fixes the situation or else cut off the offending site. In many cases it's possible to monitor the site and find out exactly what is happening. Some customers may be malicious, but a larger number are the victims of malware or hostile redirection. With some assistance, they should be able to clean up the problem.
The problem isn't always with the customer. If a number of customers are listed and have similar problems, the ISP or host should check whether its own software has vulnerabilities that need fixing.
QFEED helps ISPs to identify problem customers, but it shouldn't be taken as a definitive indication of a malicious site. The service provider should use its information as the starting point in mitigating problems.
The basic situation is similar: if customer sites are flagged, the provider needs to make sure the customer fixes the situation or else cut off the offending site. In many cases it's possible to monitor the site and find out exactly what is happening. Some customers may be malicious, but a larger number are the victims of malware or hostile redirection. With some assistance, they should be able to clean up the problem.
The problem isn't always with the customer. If a number of customers are listed and have similar problems, the ISP or host should check whether its own software has vulnerabilities that need fixing.
QFEED helps ISPs to identify problem customers, but it shouldn't be taken as a definitive indication of a malicious site. The service provider should use its information as the starting point in mitigating problems.
Reporting problems
We don't claim to be infallible. If you believe you have been listed incorrectly, you have removed an infection that caused your site to be listed, or you see some other problem, submit a report on helpdesk.quttera.com or send an email to support@quttera.com. Feedback helps us to keep QFEED as accurate as possible.
