Imposter Detection with Watchman

The talk opens with the problem of impostor domains: lookalike names registered to phish staff or run business email compromise. Fake invoices can pass email authentication because the sending domain is technically legitimate, so they often go unnoticed in accounts payable. The speaker argues that commercial monitoring services tend to alert days or weeks after registration, even though the signal exists much earlier, and that the brand to watch is often a vendor or client rather than the organisation itself.

The middle section explains how monitoring works. Registries publish zone files listing registered domains, and the speaker describes applying for registry access through ICANN. Each day's files are compared against the previous day's, so only new registrations need processing, which avoids the slow row-by-row database inserts that a naive approach would require. Matches are found with substring or string edit distance checks. The free tool, called Watchman, is a Django application that runs on modest hardware. It also watches for MX records and live websites, enriches hits with VirusTotal data, and sends alerts to Slack.

The closing part covers limits and plans. Some registries are harder to reach, passive DNS feeds are costly, and hosting the database is the main barrier to sharing results with others. Planned work includes interactive Slack actions, safer screenshots, and seeding lists from known-good addresses. The practical takeaway is that newly registered lookalike domains can be spotted early using public data, and that defenders should watch for them before mail or web content appears.