Methods, systems, and media for mitigating damage resulting from a website being an intermediary in a cyberattack

A system for mitigating damage resulting from a website being an intermediary in a cyberattack, comprising:

• a security operations center device comprising:
• memory;
• and
• a hardware processor coupled to the memory and configured at least to:
• detect a domain name server query made to a domain name server regarding the website by a user device;
• determine that a certain amount of time has passed since the website has been scanned;
• in response to determining that a certain amount of time has passed since the website has been scanned, make a request to the website;
• receive a header in response to the request;
• inspect the header to identify a software stack component of the website;
• cross-reference the software stack component to a common vulnerabilities and exposures (CVE) database to identify a CVE that applies to the software stack component;
• apply a rule to determine the impact of the CVE on whether the website is a possible intermediary in a cyberattack;
• determine that the website is a possible intermediary in a cyberattack;
• and
• take action on the website to mitigate damage resulting from the website being an intermediary in a cyberattack.

A non-transitory computer readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for mitigating damage resulting from a website being an intermediary in a cyberattack, the method comprising:

• detecting, by a security operations center device, a domain name server query made to a domain name server regarding the website by a user device;
• determining that a certain amount of time has passed since the website has been scanned;
• in response to determining that a certain amount of time has passed since the website has been scanned, making a request to the website by the security operations center device;
• receiving a header in response to the request by the security operations center device;
• inspecting the header to identify a software stack component of the website;
• cross-referencing the software stack component to a common vulnerabilities and exposures (CVE) database to identify a CVE that applies to the software stack component;
• applying a rule to determine the impact of the CVE on whether the website is a possible intermediary in a cyberattack;
• determining that the website is a possible intermediary in a cyberattack;
• and
• taking action on the website to mitigate damage resulting from the website being an intermediary in a cyberattack.