CarahCast: Podcasts on Technology in the Public Sector · Carahsoft

Safeguarding Federal Websites with Fortra Brand Protection

·39 min·2 clips

Hundreds of thousands of lookalike domains are registered each year to exploit trust in reputable companies.

1. CarahCast: Podcasts on Technology in the Public Sector covers Safeguarding Federal Websites with Fortra Brand Protection. 2. Anthony Jimenez hosts from the Carasoft production team, and Nicholas Oram speaks for Fortra as Senior SOC Manager for Domain and Dark Web Services. 3. The episode asks how federal websites can be defended against domain impersonation, lookalike domains, and phishing. 4. Oram defines domain names as mapped to IP addresses and explains the DNS hierarchy from top-level domains to second-level domains and subdomains. 5. He says generic top-level domains such as .com and .net move through five phases: available, registered and active, expiration and renewal grace period, redemption period, and pending deletion. 6. He links that lifecycle to a practical risk: a domain can be deleted and then picked up by a threat actor. 7. Oram says attackers register lookalike variations to exploit trust in reputable companies, and he says hundreds of thousands are registered each year. 8. He names common techniques including changing the TLD, adding hyphens, transposing letters, adding letters, omitting letters, and using fuzzy matching. 9. He explains typoglycemia as the reason people often recognize words even when letters are scrambled. 10. Oram says lookalike-domain attacks usually start with scouting a brand, then creating DNS records, then obtaining SSL certificates, and finally distributing links by spam, SMS, blog comments, or phishing email. 11. He says threat actors may use LinkedIn, third-party leaks, combo lists, dark web forums, and Telegram channels to gather employee names and email addresses. 12. He says Fortra’s domain monitoring depends on collection, curation, mitigation, and monitoring rather than sending clients raw data dumps. 13. He names collection sources including daily TLD zone files, DNS zone files across more than 2,000 top-level domains, SSL transparency logs, and DNS traffic. 14. He says the phishing service also uses a web beacon, partner feeds such as VirusTotal and OpenPhish, and client abuse-box data to surface threats. 15. Oram says analysts review false positives by checking domain strings, industry terms, punctuation, capitalization, page syntax, HTML content, and drop points such as email addresses or Telegram channels. 16. He says mitigation uses strategic relationships with providers, kill switch integrations, browser blocking pages, screenshots, user agents, proxies, and host information to support takedowns. 17. He says about 30% of mitigation cases are automatically handled without an analyst, and he notes that browser blocking is not the same as a domain being fully offline. 18. The style is a slide-driven technical briefing with examples from the web app and repeated emphasis on managed-service operations. 19. Security teams, public-sector web owners, and phishing defenders would get the most out of it. 20. Listeners wanting a light general overview without technical domain and DNS detail can skip it.

As heard by us

A practical look at how lookalike domains are detected, filtered, and taken down.

Caracast looks at domain impersonation, lookalike domains, and phishing protection, with Nick Oram walking through how Fortra handles the problem from collection to monitoring.

Read the full review in PlayNext →

Why you'd press play

You want a clear map of how lookalike domains get found and removed.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from CarahCast: Podcasts on Technology in the Public Sector