Faster Than a Takedown: How Collective Internet Defense Disrupts Attacks at Scale

No ratings

Presented at BSides Toronto 2026 by

Andre Piazza

Most of us measure success one host at a time: find a malicious domain, file an abuse report, and wait days to weeks (or months) for a single domain to come down. That is a takedown. It is an essential part of mitigation, but it is slow, buying the attacker time to re-host the moment it works. Underneath it runs a faster layer most defenders never learn exists: an ecosystem of collective defense made of the internet's core infrastructure operators, such as browser and OS blocklists, public resolvers, mail reputation, and verdict aggregators, that can revoke an attacker's reach in minutes, sometimes faster than DNS propagation. I did not appreciate how much reach this layer has until I pulled the operators' own numbers. In this session I show how disruption and takedown work as two complementary layers, trace how one reported verdict propagates across the fabric of the internet, ground it in public documented cases, and show you how to tap in: point your resolvers at a public option, ingest open feeds, and report your own indicators to the community platforms built for it.