1. CERT-GIB IN DNS FORUM 2018
Alexander Kalinin
Head of CERT-GIB

2. 15 specialists 27 average age 45 000 combined hours of response
CERT-GIB
CERT-GIB is established in 2011.
Competent organization also for next zones:
.SU
.TATAR/.ДЕТИ
.MOSCOW/.МОСКВА
CERT-GIB — a 24/7/365 computer security incident response team
Incident monitoring, including distribution of malicious software, phishing
Professional assistance from specialists with vast experience in response to cyber crime
Close cooperation with CERT teams, domain registrars and hosting providers from all over the world
Collection, analysis and preservation of digital evidences from IDS/IPS (include Group-IB’s solution TDS) and Intelligence systems
15 specialists
27 average age
Partner of IMPACT — International Multilateral Partnership Against Cyber Threats
combined hours of response
Accredited member of FIRST and Trusted Introducer
200+ active clients from finance, retail, telecom, blockchain, etc
Officially authorized by Carnegie Mellon University and licensed to use the “CERT” trademark in its name
Recognized as a competent organization of the CCTLD RU from 2011

3. Detected and blocked malicious resources by CERT-GIB in 2018
1 750
Detected and blocked malicious domains in .RU zone for this year
13 HOURS
Average take-down time in .RU zone for this year
5 174
Detected and blocked phishing domains in other zones

4. Detected and blocked phishing resources by CERT-GIB in 2018
TOP-5 of bulletproof registrars:
GoDaddy
Todaynic
OVH
Tucows
Google Registrar
Average take-down of domain after first contact with any of these registrars more than
1 WEEK

5. Global Data Exchange Group-IB Intelligence
Unique data and intelligence collected from over 40+ organizations:
Virustotal
Yandex Safe Browsing
Netoscope
Facebook
AVs
Antiphishing
MISP
Law enforcement agencies by request
And other organizations/clients
Other sources:
Domain monitoring
Passive DNS
TLS certificates
Advertisement
Logs from clients
Mobile markets
Other Intelligence data
Our system and analysts checks every resource and only after verification we send this data to others

6. Interrelated Malicious Resources –– whois data
Cybercriminals also can use already known s when they register the domain names. It also can help to detect new malicious domains, but only if whois data is open. In most cases this data is actually fake.

7. Interrelated Malicious Resources –– IP and TLS
New domains can use already known IPs, that was previously detected. Also some of domains can change IP and that can help to detect more potential malicious resources that related with the new IP. The same thing with known TLS, that already been used in malicious activity. We can also build the relationships with help of all this data.

8. Group-IB — one of the global leaders  in providing high‑fidelity Threat Intelligence  and anti‑fraud solutions
Alexander Kalinin
Head of CERT-GIB
, ext. 012