What malicious content does ZeroFox help to remove?

ZeroFox identifies threats, automates processing of takedown submission requests, and works on your behalf with partner networks to remove the following: Malicious and/or impersonating domains/subdomains Fraudulent and/or impersonating social media accounts Phishing websites, emails, and posts Malicious and/or unauthorized posts and comments Fraud and scam pages Rogue mobile apps Instances of piracy, counterfeiting, or brand abuse Content that violates network Terms of Service (ToS) Exposed Personally Identifiable Information (PII) of executives and VIPs Additionally, ZeroFox provides detection and early warning into account takeovers (ATOs), suspected instances of parked domains/domain squatting, attack chatter, threatening deep/dark web activities, and data leaks/breaches so you can take immediate and necessary actions to mitigate risk.

What is the ZeroFox Global Disruption Network?

The Global Disruption Network (GDN) is the result of ZeroFox’s collective efforts to help you fight back against modern adversaries. The GDN comprises a large community of participating ZeroFox customers and hundreds of the world’s leading third-party network providers to share and distribute indicators of attack (IoAs) for every identified and validated threat. This collective distribution of indicators enables proactive blocking actions to malicious content/infrastructure and helps to close threat exposure gaps for all ZeroFox customers.

What third-party provider types are included in the Global Disruption Network?

ZeroFox partners with hundreds of the world’s leading and established providers and groups such as: DNS Registrars Hosts & ISPs Content DeliveryNetworks (CDNs) Cloud Providers Telcos Link Shorteners Information Sharing and Analysis Centers (ISACs) FW/Email/EPP Block List Endpoint Security Working Groups For more details on ZeroFox’s disruption partners, see the ZeroFox App Library page.

What threat indicator data is distributed via the Global Disruption Network endpoint?

ZeroFox uses a combination of automated communication streams and a dedicated API endpoint to communicate correlated malicious URLs and indicators to the Global Disruption Network (GDN). Each entry in the GDN endpoint provides: Source (Domain, Social) URL & Fully Qualified Domain Name (FQDN) Type(s) (Phishing, Trademark, Impersonation, Copyright, Abuse, Counterfeit, PII) HTTP Status Code Autonomous System Number (ASN) Internet Assigned Numbers Authority (IANA) IPv4 address Host & Registrar

What types of disruption actions does reporting to the Global Disruption Network result in?

In addition to managing and processing takedown requests, ZeroFox and the Global Disruption Network work proactively to significantly reduce threat exposure gaps. Example disruption actions: Blocking via related infrastructure (IPs,URLs, DNS, hosts, forward proxies, etc.) Addition to common security block lists Ingestion of malicious content on endpoint security blacklists Removal of malicious links via top link shorteners See more details around the Global Disruption Network’s disruption actions here .

What is ZeroFox PII Removal Service?

PII Removal by ZeroFox helps you to close security gaps by finding and removing personal information for executives and employees that are often disseminated and/or put up for sale by threat actors. Our solution delivers a frictionless experience for both the employee and the security team with ongoing monitoring and automated removal on your behalf, providing an additional layer of security for your company, your employees, and your executives.

NEW - See and secure external assets | Announcing ZeroFox EASM

Request Demo

Adversary Disruption

Leading global takedown service, comprehensively removing fraudulent sites and content, and disrupting attacker campaigns at scale

Get a Demo

Why do I need Adversary Disruption?

Today’s adversaries utilize sophisticated attack infrastructures to quickly deploy large volumes of malicious attacks across multiple surfaces (web, social, mobile apps, etc.) – potentially exposing millions of employees, customers and brands. The criminal underground is becoming increasingly sophisticated at scaling and executing phishing, fraud, and attack campaigns. Pursuing takedowns of this fraudulent content in compliance with legal policies and network terms of service is a top priority, however, this process can be complex, costly, and can take days or even weeks to resolve. You need proven automation that can execute takedowns at scale to stay ahead.

How does ZeroFox Adversary Disruption help?

ZeroFox is committed to reducing the costs and complexity of social and domain takedowns. ZeroFox’s Adversary Disruption provides an industry-leading takedown automation service, a wealth of expertise from threat analysts, and the collective intelligence of our Global Disruption Network (GDN) to quickly share indicators of active and emerging threats, remove the offending content, and block access to malicious attack infrastructure. With hundreds of thousands of disruption actions taken every week, ZeroFox helps your security team to scale takedown efforts across a wide variety of uses and channels while significantly reducing the impact of active attack campaigns.

Tour the Global Disruption Network (GDN)

ZeroFox in action

Total Defense Against Digital Threats Outside Your Perimeter.

successful takedowns in the past 12 months

disruption actions performed every week

ROI for impersonation takedowns

leading global disruption partners

Key benefits of adversary disruption

Rely on Comprehensive Disruption

Take down threats and impersonations for virtually every network, target type, global region, and protection use case - ZeroFox does everything possible to process and prosecute takedowns on your behalf without needing to consult multiple sources.

Scale Remediation Efforts

Utilize an industry-leading managed takedown service that identifies, processes, and removes large volumes of active threats across even the smallest and most obscure network providers.

Save time and maximize resources

Leverage streamlined threat takedown workflows, in-platform request automation, and a team of expert disruption analysts who serve as an extension of your team.

Close threat exposure gaps

Reduce risk and avert future attacks via proactive blocking actions of malicious content and automated PII removal.

Key features of adversary disruption

Automate takedown processing, pursuance, and prosecution across a variety of use cases such as phishing domains, brand abuse, malicious content, and impersonating accounts and profiles.

Comprehensive adversary disruption & remediation use cases

Threat Type	Use Case	Disruption/Remediation Action
Social Media	Social Media
Brand Impersonations & Misuse of IP	Accounts/pages that misappropriate protected brand names Misappropriating brand logos/Images	Takedown Blocking Actions via the Global Disruption Network
Executive/VIP Impersonations	Accounts/pages that use impersonating names and pictures relating to an executive/VIP No clear disclosure that it's not a fan or parody account/page		Takedown Blocking Actions via the Global Disruption Network
Counterfeiting & Piracy	Accounts/posts sharing images, names, or calls to action for unauthorized sale of counterfeit goods Accounts/posts illegally hosting or distributing copyrighted digital content		Takedown Blocking Actions via the Global Disruption Network
Fraud & Scams	Accounts/posts targeting employees and/or customers with fraudulent information or calls to action with the intent to defraud, deceive or cause harm to users Examples include: money flipping, fake coupons, etc.		Takedown Blocking Actions via the Global Disruption Network
Violence, Harassment Misinformation	Accounts/posts with targeted abuse or threats of harm toward an individual, brand, or public figure		Takedown Blocking Actions via the Global Disruption Network
Owned Social Account Risk	Unauthorized posts from owned accounts Indicators of account takeover Leaks of PII or sensitive information from owned accounts	Inline content remediation of authenticated owned corporate accounts and business pages
Web Domains	Web Domains
Phishing Domains	Live, hosting malicious content Impersonating domain or subdomain of a legitimate name Using branded content (ie. logos, website code, etc.) Often includes form or call to action	Takedown Blocking Actions via the Global Disruption Network
Phishing Email Addresses	Email addresses used to send phishing emails May be private domain or public ISP		Takedown Blocking Actions via the Global Disruption Network
IP Infringement	Live, hosting content that abuses IP or copyrighted material Impersonating protected domain name/ branded content			Takedown Blocking Actions via the Global Disruption Network
Cybersquatting	Using protected domain name but no evidence of phishing or IP abuse	Continuous domain monitoring for malicious activity Assess for UDRP or URS filing
Personal Identifiable Information (PII) Risk	Personal Identifiable Information (PII) Risk
Executive/VIP PII Exposure	PII is exposed and for sale on indexed data broker websites	PII Removal

Take Action Against Domain Squatters with ZeroFox’s UDRP Solution

Have a domain dispute that infringes on your brand’s owned trademarks? ZeroFox works with the World Intellectual Property Organization (WIPO) on your behalf to assess and file Uniform Domain-Name Dispute-Resolution Policy (UDRP) complaints so you can effectively claim ownership and/or remove cybersquat domains. Ready to get started?

READ THE UDRP DATASHEET

Chris Stewart, VP Global Alliances
We are proud to be an active partner in the ZeroFox Global Disruption Network. Using ZeroFox external threat intelligence on malicious IPs and domains helps our customers and connected communities prevent repeat attacks and disruption.
Read The Full Case Study

Frequently asked questions

Adversary Disruption is ZeroFox’s unique solution for remediation of external threats. Not only does it provide a fully automated and managed solution for taking down malicious accounts, domains, and posts, with controls for inline content removal in corporate accounts, but it also goes a step further by taking proactive blocking actions via distribution of indicators to the Global Disruption Network. This two-pronged approach of removing fraudulent content combined with neutralizing attacker infrastructure is what sets ZeroFox’s Adversary Disruption apart from traditional takedown solutions.

Adversary Disruption

Why do I need Adversary Disruption?

How does ZeroFox Adversary Disruption help?

Total Defense Against Digital Threats Outside Your Perimeter.

Key benefits of adversary disruption