I seem to recall someone I knew who relied on them for sinkholing malware. He'd basically reverse engineer the command and control, write his own version, repor

I seem to recall someone I knew who relied on them for sinkholing malware. He'd basically reverse engineer the command and control, write his own version, report the domain (usually some gibberish like kfgrgerrkritptjfnfkdnfffkergb.com), buy it as soon as it went on the market, and then take over the botnet associated with it to disable the thing and report it to affected companies. Pretty sure his company doing this got bought out by looking glass. Looking that technique up it seems Kaspersky did some of this too at one point: https://www.kaspersky.com/about/press-releases/2012_how-kaspersky-lab-and-crowdstrike-dismantled-the-second-hlux-kelihos-botnet-success-story https://www.kaspersky.com/about/press-releases/2012_how-kasp... I'm not entirely sure how effective or relevant this kind of method is these days but I wouldn't be surprised if it was something you could still pull off now.