Founder @ Security Land · Cybersecurity & IT Strategy Consultant · Threat analysis, network security & data protection
Founder of Security Land and CEO of PRS, with 25+ years in ICT. I write practical, no-hype analysis of the latest vulnerabilities, zero-days and incidents — and what security and infrastructure teams should actually do next. Focus areas: network security, DLP, encryption/HSM, identity and threat intelligence. More at symantecland.com
Markdown supported · ⌘↵ to post
Furqan Ashraf
"DMARC does not stop them" should be printed on every email admin's monitor.
On actually doing the lookalike monitoring, since that's where teams tend to stall: dnstwist on a schedule against your own domain is a fine free start. Where it gets thin is homoglyph variants and brand-plus-keyword names like
yourbrand-support, which are exactly what BEC crews use for executive impersonation.If you'd rather not run that yourself, WhoisFreaks Brand Monitoring scans new registrations twice a day for typos, homoglyphs, keyword combos and TLD swaps, and alerts by email or webhook. Disclosure: I work there. There's a one-brand trial on request.
Either way, the output slots nicely into your week-two gateway review as the list behind "domains that look like your own."