Neutralizing malicious locators
Methods and systems for neutralizing malicious locators. Threat actors may shut down their web pages or applications (i.e., resources) that serve malicious content upon receiving request(s) configured to be perceived by the resource as non-browser requests. Therefore, initiating (large-scale) non-browser requests, or requests that are at least perceived as non-browser requests, may effectively act to inhibit, or even nullify, intended attack vectors.
1. A method for neutralizing at least one malicious locator accessible through a network, the method comprising:
identifying, through a computer interface within a computing device comprising a non-transitory computer-readable medium that is not a transitory signal, a plurality of locators received through a communication network, each locator comprising a location of a malicious network-accessible resource that is associated with a malicious service that is suspected of serving malicious content;
requesting content from a locator of the plurality of locators via at least one non-browser program repeatedly until the malicious network-accessible resource discontinues the malicious service;
after a certain number of non-browser requests have been transmitted to the locator, transmitting browser requests for content from the locator, and when the malicious network-accessible resource is unavailable or otherwise does not return content, identifying that the malicious service was serving malicious content and was triggered into shutting down by receiving the non-browser requests; and
issuing an alert to inform an end-user that the particular locator has been shut down or adding the network location to a list of malicious network locations.
2. The method of claim 1 , wherein the locator is a uniform resource identifier (URI).
3. The method of claim 1 , wherein requesting content from the locator includes requesting content through at least one of a curl command or a wget command.
4. The method of claim 1 , wherein requesting content from the locator includes requesting content via a plurality of non-browser programs.
5. The method of claim 1 further comprising associating the non-browser program with a desired internet protocol (IP) address.
6. A system for neutralizing at least one malicious locator accessible through a network, the system comprising:
a computing interface within a computing device comprising a non-transitory computer-readable medium that is not a transitory signal;
a network interface; and
a processor in communication with the non-transitory computer-readable medium interface and the network interface, the processor configured to:
identify a plurality of locators received through a communication network, each locator comprising a location of a malicious network-accessible resource that is associated with a malicious service that is suspected of serving malicious content;
request content from a locator of the plurality of locators via at least one non-browser program repeatedly until the malicious network-accessible resource discontinues the malicious service;
after a certain number of non-browser requests have been transmitted to the locator, transmit browser requests for content from the locator, and when the malicious network-accessible resource is unavailable or otherwise does not return content, identify that the malicious service was serving malicious content and was triggered into shutting down by receiving the non-browser requests; and
issue an alert to inform an end-user that the particular locator has been shut down or add the network location to a list of malicious network locations.
7. The system of claim 6 , wherein the locator is a uniform resource identifier (URI).
8. The system of claim 6 , wherein the processor requests content via at least one of a curl command or a wget command.
9. The system of claim 6 , wherein the processor is configured to request content from the locator via a plurality of non-browser programs.
10. The system of claim 6 , wherein the network interface is associated with a desired internet protocol (IP) address.
11. A non-transitory computer readable medium containing computer-executable instructions for performing a method for neutralizing at least one malicious locator accessible through a network, wherein the non-transitory computer readable medium is not a transitory memory device, the medium comprising:
computer-executable instructions for identifying, through a computer interface within a computing device comprising a computer-readable medium, a plurality of locators received through a communication network, each locator comprising a location of a malicious network-accessible resource that is associated with a malicious service that is suspected of serving malicious content;
computer-executable instructions for requesting content from a locator of the plurality of locators via at least one non-browser program repeatedly until the malicious network accessible resource discontinues the malicious service;
computer-executable instructions for after a certain number of non-browser requests have been transmitted to the locator, transmitting browser requests for content from the locator, and when the malicious network-accessible resource is unavailable or otherwise does not return content, identifying that the malicious service was serving malicious content and was triggered into shutting down by receiving the non-browser requests, and;
computer-executable instructions for issuing an alert to inform an end-user that the particular locator has been shut down or adding the network location to a list of malicious network locations.