Method and system for detecting distributed internet crime

A computer-based method for detecting distributed Internet crime, comprising the steps of:

• collecting, using a processor for at least one specially programmed general purpose computer, first data regarding a plurality of Internet nodes, wherein the first data is collected at a first time, wherein the first data is collected by a method free of collection modifications to Internet nodes in the plurality of Internet nodes, and wherein collecting the first data includes performing first multiple scans, including first multiple probes transmitted to multiple destinations, of the plurality of Internet nodes;
• generating, using the processor and the first data, first topology and performance data for a first plurality of destinations associated with distributed Internet crime and first Internet topology or performance, the first topology and performance data with respect to at least one router for the first plurality of destinations;
• identifying, using, the processor and the first topology and performance data, a first node from the plurality of Internet nodes to which the at least a portion of the first plurality of destinations is connected;
• generating, using the processor, second topology and performance data for at least one first destination connected to the first node and not associated with the first Internet topology or performance;
• inferentially geolocating the first node, using the processor, by comparing the first and second topology and performance data, wherein comparing the first and second topology and performance data includes comparing respective latencies in the first and second topology and performance data;
• collecting second data, using the processor, regarding the plurality of Internet nodes, wherein the second data is collected at a second time, later than the first time, wherein the second data is collected by a method free of collection modifications to Internet nodes in the plurality of Internet nodes, and wherein collecting the second data includes performing second multiple scans, including second multiple probes transmitted to multiple destinations, of the plurality of Internet nodes;
• generating, using the processor and the second data, third topology and performance data for a second plurality of destinations associated with distributed Internet crime and second Internet topology or performance, the third topology and performance data with respect at least one router for the second plurality of destinations;
• identifying, using the processor and the third topology and performance data, connection between the first node and at least a portion of the second plurality of destinations;
• generating, using the processor, fourth topology and performance data for at least one second destination connected to the first node and not associated with the second Internet topology or performance;
• inferentially geolocating the first node, using the processor, by comparing the third and fourth topology and performance data, wherein comparing the third and fourth topology and performance data includes comparing respective latencies in the third and fourth topology and performance data;
• and,
• generating, using the processor, a report identifying an organization associated with the distributed Internet crime.