Netcraft

We're exhibiting at IndoSec 2026 in Jakarta, Sept. 15 – 16. As Indonesia's digital economy scales toward $360B by 2030, so does the attack surface — phishing, brand impersonation, fake banking apps. Netcraft's team will be at booth E26 talking through how we're getting takedowns done in a 33-minute median, 21x faster than traditional providers. If you're attending, come find us. #IndoSec #IndoSec2026 #CNAPP

The squad is rolling out to Global Anti-Scam Alliance (GASA) this week, see you there!

Big news from last week, #ICYMI

Attackers are using known brands like #Amazon to spin up fake gambling apps and sites (services that the company otherwise doesn't offer) and steal users' credentials or funds. Here are some examples of what these sites and ads look like and how they're being distributed, and read at the link in the comments.

We're hiring for several global positions, including... Technical Operations Specialist: https://lnkd.in/ezNyCJWB APAC SDR: https://lnkd.in/ey7KDw-N Cybercrime Analyst – U.K.: https://lnkd.in/e-fFc5z9

You might have heard about #geofencing in the context of Pokemon Go or your Amazon delivery, but did you know attackers are using it, too, to make sure only potential victims visit their #phishing pages? Get the basics of geofencing and cloaking in the context of #cybersecurity in this week's newsletter.

We're pleased to announce Darren Lee has joined Netcraft's board of directors. He spent 14 years at Proofpoint, joining when it was private and under $100M ARR and leaving it a public company past $2B and 4,000 employees. We take down nearly one-third of the world's phishing sites and have blocked 230 million+ multichannel threats to date. As attackers use AI to scale phishing, impersonation, and fraud, we are moving further left, disrupting criminal infrastructure before it is weaponized. Darren has seen this stage of a company before. That perspective matters. Link to full announcement in comments.

One financial technology company stopped optimizing for detection coverage and started optimizing for takedown speed. Account takeovers dropped 90%. Our CEO Ryan Woodley breaks down why "outcomes over impressiveness" should be the litmus test for every security purchase — and the four pillars that separate a real strategy from a stack of over-hyped tools. Link in comments.

If you were to ask an AI assistant "What is the official Kohl's website?" It might confidently recommend a link — styled convincingly, right down to AI-generated product images. That fake page is just there to steal your credit card information. AI search tools can recommend live phishing pages by name for banks and major retailers, not just outdated or hallucinated links. As answer engines become the front door to the web for more users, this is a brand risk most companies aren't monitoring yet. More ⤵️ #AI #LLMs #scams

Instead of hand-coding #phishing detection avoidance, threat actors can now subscribe to #AI-powered cloaking platforms that evaluate every visitor — location, device, browser behavior — before deciding whether to reveal the malicious page or a harmless dead end. It's a good reminder that the "attack" itself is only half the problem. The infrastructure hiding it has gotten just as sophisticated. We dug into how cloaking-as-a-service works and what it takes to see past it.