Threatconnect, Inc.

Richard M Barger

Bhaskar Karambelkar

Wade Baker

In some embodiments, an apparatus includes a memory and a processor operatively coupled to the memory. The processor is configured to receive a set of domain name resolutions associated with a domain. Each domain name resolution from the set of domain name resolutions includes a mapping between a domain name and an Internet Protocol (IP) address. The processor is then configured to determine, based on the set of domain name resolutions, a set of resolution metrics associated with a first geolocation and a set of resolution metrics associated with a second geolocation. The processor is also configured to compare and identify a role of an adversary infrastructure at the first geolocation and a role of an adversary infrastructure at the second geolocation, and subsequently send a signal such that a remedy response associated with at least one of the set of IP addresses or the domain name is initiated.

Growing community of inventors

Centreville, VA, United States of America

Richard M Barger