\u201cRight now, most DNS servers are complicit in the crime.\u201d<\/p>\n
Craig Sanderson did not ease his audience into that conclusion. Speaking on the Cyber Strategies Stage at ExCeL London on Wednesday, June 3, our cybersecurity strategist opened the Infoblox Infosecurity Europe 2026 session, Using Protective DNS to Dismantle Global Scam Networks<\/em>, with a premise most defenders rarely say out loud: the internet\u2019s address book does what attackers ask of it. A user clicks a phishing link, the resolver answers and the scam proceeds. Joined on stage by Cliff Wright, senior manager, Threat Intelligence at Infoblox, Craig spent the next 20 minutes arguing that the same infrastructure can be turned against the criminals who exploit it, and that Protective DNS is how you do it at scale.<\/p>\n Craig and Cliff expand on several of these themes in companion videos on the Infoblox YouTube channel.<\/p>\n Craig opened with numbers designed to recalibrate the room. \u201cIf you took the size of the global economy from a scam point of view, it would only be behind the United States and China in size,\u201d he said. In the United Kingdom alone, he noted, fraud now accounts for 20 percent of all crime, and two thirds of that fraud is cybercrime.<\/p>\n Faced with figures like that, the instinct is to call for more prosecutions. Craig didn\u2019t entertain the idea: \u201cProsecuting our way out of this problem is just not viable.\u201d Much of the industry operates from scam compounds in Myanmar, Cambodia and Laos, where, by his account, the proceeds of cybercrime amount to roughly 46 percent of GDP. Expecting those jurisdictions to dismantle their largest revenue stream is not a strategy.<\/p>\n Cliff described what those compounds have become: operations the size of small towns, with the integrated functions of a real enterprise. Recruitment, training, scriptwriters and vast numbers of workers, many of them trafficked and forced into the work. \u201cIt\u2019s kind of an industrial revolution of sorts,\u201d he said. Profits get reinvested into the compounds, and the machine grows. Craig and Cliff unpack the economics of this criminal industry in a companion video series, Using Protective DNS to Dismantle Global Scam Networks, on the Infoblox YouTube channel: Episode 1<\/a>, Episode 2<\/a> and Episode 3<\/a>.<\/p>\n The session\u2019s strangest evidence came from a United Nations report connecting organized crime to sponsorship of European football clubs. Cliff, who brings more than two decades in threat research, called it \u201cprobably the boldest thing that I\u2019ve seen so far in 20-something years of working in this industry.\u201d The payoff for the criminals, he explained, is legitimacy: \u201cThey\u2019ve ended up with this layer of credibility, this reputational armor, if you like.\u201d Regulators, victims and potential partners see a brand on a football shirt and stop scrutinizing it.<\/p>\n Craig made it personal. As a Crystal Palace supporter, he pointed out, \u201cI was also like a walking advertising board for illegal Chinese gambling,\u201d referring to a former shirt sponsor later tied to illegal gambling operations in the Far East. The club, he was careful to note, was happy to take the money but most likely had no understanding of where it came from. That is the point: these operations manufacture brands from scratch, complete with payment systems, crypto rails and holding companies, then hide inside the legitimate economy.<\/p>\n The same plain-sight logic powers the technical machinery. Cliff walked the audience through traffic distribution systems (TDSs): redirection networks that intercept a user after a click and route them wherever the attacker wants, profiling them along the way through data leaked in HTTP requests. Marketing teams have used TDSs legitimately for years, which is precisely why criminal versions blend in. The malicious variants add cloaking, filtering out researchers, law enforcement, sandboxes and bots, while delivering hyper-personalized lures to real victims. \u201cThere\u2019s no point presenting a scam in a completely different language to the victim,\u201d Cliff observed. The right threat reaches the right victim at the right time.<\/p>\nThe Third-Largest Economy Nobody Elected<\/h3>\n
Reputational Armor: Crime in Plain Sight<\/h3>\n