Reducing the time your customers spend analyzing reports by weeks is quite an achievement. Here's how Spamhaus Intelligence API assisted Red Sift in accomplishing that and more.

Who is Red Sift?

The Red Sift Open Cloud is a data analysis platform that is purpose-built for the challenges of cybersecurity. By harnessing the power of Artificial Intelligence (AI), it securely collates, computes & visualizes data from thousands of individual signals, delivering intelligent automation to its global customers.

In the beginning…

From its inception in 2015, Red Sift’s client portfolio has rapidly grown. Product development teams were always aware that they would need to lean on threat intelligence data to help them keep one step ahead of the competition.

Initially, for their OnDMARC and OnINBOX products, they required DNS blocklists (DNSBLs) to validate the reputation of IPs and domains sending email. For the OnINBOX product, utilizing blocklists helps Red Sift supply customers with an Authentication, Contents and Trust score (ACT) highlighting what emails are safe to interact with, helping combat Business Email Compromise (BEC).

After trialing various DNSBL vendors, Red Sift chose Spamhaus’ IP and Domain blocklists. Multiple factors led to this decision, including the quality and consistency of Spamhaus’ datasets, not to mention its global footprint providing widespread coverage. Additionally, accessing the DNSBLs was simple with Spamhaus’ Data Query Service. This provided Red Sift with a set-and-forget solution, which hasn’t failed since it went live in 2015.

Meeting and exceeding customer demands

With an increasing number of enterprise-sized customers, Red Sift was servicing more complex infrastructures. This meant a greater volume of report generation.  One key aspect of DMARC is classifying your assets listed in these reports and mapping IPs to known senders.

In the first instance, customers had to undertake manual analysis, primarily done via lengthy internal conversations or outsourcing to consultants, both expensive and time-consuming.

With Red Sift’s focus on intelligent automation, they turned to Spamhaus Intelligence API (SIA), enabling them to provide their customers with additional insights that saved time and quickly highlighted urgent areas to focus on.

How did Spamhaus Intelligence API help?

This API provides a wealth of metadata related to listings in Spamhaus’ blocklists, specifically the Exploits Blocklist (XBL), which lists IPs related to compromised behavior, e.g., machines infected with malware.

A DNSBL provides a binary “yes, it is listed” or “no, it is not listed” response. Meanwhile, SIA provides numerous data points relating to the listed IP address, furnishing the user with more in-depth insight into the compromised IP’s activity.

When Red Sift identifies an IP listing on the XBL, they make a call to the API. Currently, 20-25% of all IP addresses they process are listed on the XBL and therefore called into SIA.

With the added intelligence SIA provides, Red Sift can automatically score the IP and provide its customers with the relevance of why the IP is being blocked; automated, immediate intelligence.

How are Red Sift’s customers benefiting?

As previously mentioned, before SIA, enterprise customers were manually working through hundreds of reports. Now Red Sift automates the analysis, giving a contextual layer of why an IP is considered “bad.”

Users of OnDMARC can now log in and view a list of senders, along with an IP score that delivers a quick health check.  This score can indicate to users if a legitimate sender has bad list hygiene or, worse, unsolicited use.

This intelligence is invaluable for OnDMARC users, saving them from sifting through reports and wasting valuable time, providing instant insight into what to prioritize and focus on.

One customer, a specialized agency of the United Nations, used OnDMARC to analyze over 29,000 sending IPs in just minutes. The intelligent automation behind this analysis was powered using SIA. As a result, 22% of their sending IPs were instantly highlighted as “known malicious,” saving the organization weeks of work.

In the words of Deepak Prabhakara, Red Sift’s Founding Engineer and CTO, “Spamhaus data allows us to add huge amounts of value for our customers and beyond.

How is Red Sift benefiting?

Here are the additional benefits being experienced by Red Sift:

Saving time: With the additional insight SIA brings, Red Sift’s Customer Success Teams can quickly classify potential threats, dramatically reducing report analysis time, freeing them up to provide additional value to their customers.

Scalable solution: In the words of Deepak, “We don’t have to worry about scale. The data is easy to access and a great benefit for us.” He added, “We can push as much traffic as we need towards Spamhaus, and we know it’s going to work.”

Product innovation: Red Sift utilizes SIA to help realize their product roadmap, and there’s more in the pipeline for Red Sift’s customers in terms of automation and further insights.

Simple implementation: Deployment of DQS was very straightforward, with standard DNS queries. For SIA, the Red Sift technical team uses a specially written reverse proxy, which goes from the client, performing a DNS request, caching it and automating the token refresh, avoiding the potential of multiple active tokens.

Today and looking to the future

The threat intelligence that SIA provides Red Sift is assisting them with product innovation. As a result, their customers rapidly gain visibility of problem IPs and understand the context surrounding the issue. This enables them to remediate issues far quicker. Ultimately, productivity is significantly increased, which is always a positive outcome.

Meanwhile, Red Sift can focus on further innovations, while Spamhaus is detecting threats 24/7 on their behalf, delivering accurate IP and domain reputation data via a robust infrastructure.

 

Related products

Spamhaus Intelligence API (SIA)

Spamhaus Intelligence API (SIA) contains context-rich metadata relating to IP and domain reputation. Integrate this data with your applications to enhance existing data feeds, or consume as an independent data source.

In this easy-to-consume format, SIA can be used for threat detection and investigation, risk scoring, customer vetting, validation and much more.

  • Save valuable time investigating and reporting
  • Simple and quick to access
  • Data you can trust in

Second beta release of domain reputation via API – increased actionable data

10 March 2023

Blog News

Beta users tested. They provided feedback. Our product development team listened and then moved heaven and earth to produce a much-improved API.

Increased performance and search capabilities for users of IP reputation data via API

28 October 2022

Blog News

Commercial or developer subscribers to any IP datasets via Spamhaus Intelligence API (SIA) will experience improved performance and search capabilities for this service.

New beta release | Rich domain reputation data via API – register now

14 September 2022

Blog News

Discover the rich domain-related data points available via this easy-to-consume API and how you can become one of only 30 beta testers.