Real estate professionals spend thousands of dollars generating leads and building recognizable brands. But forgotten website domains can become an overlooked security risk — allowing criminals to impersonate agents and brokerages in emails that could put clients’ money and sensitive information at risk.
Gary Ashton, founder of The Ashton Real Estate Group at REMAX Advantage in Nashville, Tennessee, discovered the problem after working with Alex Shakhov, founder of SH Consulting, a firm specializing in email deliverability, security and infrastructure.
Ashton had accumulated roughly 400 domains over the years, including names intended for future expansion, marketing campaigns and brand protection.
Many sat unused in his GoDaddy account, waiting for a possible future purpose.
Shakhov, who had been helping Ashton improve email performance, decided to examine those dormant domains. Findings revealed a problem that Ashton had not known existed.
“We spend all this money on generating leads, creating leads, trying to communicate with leads, but then we don’t spend any money on making sure we can actually deliver the message,” Ashton told HousingWire. “As far as I’m concerned, [the unused domans are] like something that you’ve put in the garage. [Shakhov] found out that some of those domains were being used to spoof our organization — sending out emails, and I had no clue.”
The Ashton Real Estate Group ranks as a national powerhouse among enterprise teams on RealTrends Verified — reporting just under $710 million in volume across 1,324 transactions in 2025.
That was good enough for respective national placement of No. 9 (volume) and No. 11 (transaction sides) and a No. 1 ranking in both categories in Tennessee.
Domain scam investigation
Without appropriate email authentication protections, criminals can forge the sender information in messages to make them appear to come from a trusted business.
That does not necessarily mean criminals have broken into an agent’s email account. Domain spoofing can allow them to impersonate a business without knowing its login credentials, experts say.
Shakhov said his investigation found unauthorized email activity involving 79 of Ashton’s supposedly dormant domains.
The messages failed email authentication checks and originated from IP addresses in multiple countries — including China and Russia.
“Anyone could start sending emails on behalf of [whatever] domains they want, and they can send whatever they want,” Shakhov said. “They don’t need to have access to someone’s email account to send emails on their behalf because they can just simply replace the ‘mail-from’ name and send emails from Gary’s team, from REMAX, from other teams.
“There is a way to have those email addresses and domains protected by deploying security protocols.”
The team could not confirm the contents of the fraudulent messages sent using Ashton’s dormant domains or whether those particular messages reached clients. However, Shakhov said similar schemes commonly involve phishing attempts, fraudulent invoices and requests to wire money.
Real estate transactions are particularly attractive targets because criminals can exploit public property information, ongoing negotiations and the large sums transferred at closing.
A convincing email impersonating an agent, title company or other trusted participant can persuade an unsuspecting buyer to send funds to a criminal’s account.
The FBI’s 2025 Internet Crime Report recorded 12,368 real estate fraud complaints and approximately $275.1 million in reported losses.
Business email compromise accounted for about $3.04 billion in losses across 24,768 complaints.
Email authentication is key
Shakhov helped secure Ashton’s domains by setting up email security measures that verify whether messages are legitimately sent by the domain they claim to come from.
These protections help email providers identify fake messages and block them before they reach someone’s inbox.
After protections were implemented across the affected dormant domains, reports of unauthorized messages fell from 235 in the five weeks before enforcement to 43 in the following five weeks.
Remaining reported messages were rejected rather than delivered, according to the team’s findings.
“The email deliverability problem was solved,” said Shakhov. “We monitor email security for about 900 teams. We have about 1500 domains connected to our platform, and we have roughly 900 teams sending us their security reports — and roughly 35 to 40% of those teams are being spoofed.
“There are literally scammers behind those domains sending emails to their customers, to other agents, to the title companies and to their brokerage companies.”
Protection benefits extend beyond preventing fraud. Unauthorized traffic can damage a brokerage’s and domain’s reputation with email providers, potentially causing legitimate marketing messages, listing alerts and client communications to land in spam folders.
“It’s so fundamental to just assume that when you send an email, when you set your email up, that it’s going to get delivered,” Ashton said. “Well, we know that people have spam complaints and things like that, so we’ve gone through all of the setup to make sure that we’re compliant in that respect — making sure there’s opt-outs and so on.
“Alex came in and really take care of making sure that our deliverability, which I think without him that was probably trending downwards, which I wasn’t truly aware of. It’s not something that I was looking at every day.”
Make security part of everyday operations
For agents and brokers without dedicated cybersecurity staff, Shakhov recommends starting with email security and reviewing how they handle suspicious messages.
“Cybersecurity for real estate agents is something incredibly difficult because they typically cannot afford to pay a cybersecurity consultant to set up their controls,” he said. “What they really need to pay attention to is what exactly they pay and what exactly they click when they receive emails — because this is source No. 1 when it comes to hijacked email accounts.”
Brokerages should inventory every domain they own — including legacy brands, neighborhood websites, campaign addresses and registrations managed by former vendors.
Experts also stress the importance of separating domains that legitimately send email from those that should never send it, then have a qualified provider configure appropriate protections and ongoing monitoring.
Agents are advised to use unique passwords for every account, enable multifactor authentication and avoid clicking unexpected links or attachments.
The National Association of Realtors offers a cybersecurity checklist with additional guidance for real estate firms.
“Business would have just probably gone down, and I would have kept getting spoofed,” Ashton said of the likely outcome if he hadn’t sought outside help. “Then, we probably would have got to some case where somebody lost a ton of money. But we take all of the other other protocols and precautions like making sure that we’re not giving out wiring addresses and things like that.
“We’ve done everything that we’re supposed to be. All this other stuff that’s beyond our control, Alex has really helped with.”
For real estate professionals, protecting a brand means more than owning the right website address.
It also means ensuring criminals cannot easily use that address to impersonate the business, undermine client trust or put a closing at risk.
