Monitoring and Early Warning

Learning Objectives

• After this, students can explain why continuous monitoring is needed on top of one-time audits.
• After this, students can set up free alerts for names, brands, and breached accounts.
• After this, students can use dnstwist to find lookalike domains and automate the check.
• After this, students can use certificate transparency logs as an early-warning source.
• After this, students can design a simple, sustainable monitoring routine for a person or an organization.

Why Monitor?

An OSINT audit is a snapshot. The day after you finish:
- Someone registers a lookalike of your domain for a phishing campaign
- An employee’s laptop gets infected with an infostealer
- A new breach is published that includes your users’ emails
- A fake “support” account using your logo appears on social media
- A data broker re-lists your home address

Monitoring turns OSINT into an early-warning system. The earlier you know, the earlier you can respond: block a phishing domain before the campaign starts, reset credentials before they’re used, or report a fake account before customers fall for it.

Google Alerts

Google Alerts emails you when new results match a search term. It’s free and takes minutes to set up.

Useful alerts for an organization:
- "Company X" and common misspellings
- Executive names in quotes: "Jane Doe" "Company X"
- Domain names: "companyx.com"
- Product names
- Risk terms: "Company X" breach, "Company X" leak, "Company X" ransomware

Useful alerts for a person:
- Your name in quotes (plus city or school to reduce noise)
- Your usernames

Settings to adjust: how often (as-it-happens, daily, weekly), sources, language, region, and “only the best results” vs. “all results.”

Limitations: Google Alerts is not comprehensive. It misses a lot, especially social media and anything not indexed by Google. Treat it as one signal among several.

Have I Been Pwned (HIBP)

For individuals

• Notify me: register your email address and HIBP emails you if it appears in a future breach it loads.

For organizations: domain monitoring

HIBP can show and alert on every breached email address on a domain you control.
- Verification is required. You must prove you control the domain before seeing results, so attackers can’t use it to list your employees. Methods include adding a DNS TXT record, receiving an email at one of several predefined addresses on the domain, uploading a file to the website, or adding a meta tag to the home page.
- Each domain is verified separately. Verifying a root domain doesn’t cover its subdomains.
- Free vs. paid: the free tier covers domains with up to 10 breached addresses. Larger domains need a paid subscription, priced by the number of breached addresses.

What to do with a hit

• Identify which breach and what data was exposed (passwords? just emails?).
• Force password resets where passwords were involved, and check whether the affected accounts reused passwords elsewhere.
• Expect targeted phishing that references the breach.

Lookalike and Typosquat Domains with dnstwist

Attackers register domains that look like yours to host phishing pages and send convincing emails. dnstwist generates thousands of possible lookalike domains and checks which ones are actually registered.

Permutation types (examples for companyx.com)

Install

pip install dnstwist[full]      # Python
sudo apt install dnstwist       # Debian / Ubuntu / Kali
brew install dnstwist           # macOS
docker run -it elceef/dnstwist  # Docker

Common commands

# Only show lookalike domains that are actually registered
dnstwist --registered companyx.com

# Check whether lookalikes have mail servers (MX records) that could receive misdirected email
dnstwist --registered -m companyx.com

# Add dictionary-based permutations
dnstwist --registered --dictionary dictionaries/english.dict companyx.com

# Export for analysis
dnstwist --registered --format csv companyx.com | column -t -s,
dnstwist --registered --format json companyx.com | jq

# Compare page content (--lsh) or screenshots (--phash) to your real site
dnstwist --registered --lsh companyx.com
dnstwist --registered --phash companyx.com

# Add GeoIP location of the hosting IP
dnstwist --registered --geoip companyx.com

Safety note: plain DNS lookups don’t contact the lookalike sites, but --lsh and --phash fetch pages from them. Those sites may be malicious, so run those options from an isolated VM. In class, only run dnstwist on the instructor’s own domain.

Automate it

Run dnstwist on a schedule and alert only on new registrations:

#!/usr/bin/env bash
# lookalike-check.sh — run daily from cron
DOMAIN="companyx.com"
DIR="$HOME/dnstwist-monitor"
mkdir -p "$DIR"
TODAY="$DIR/$(date +%F).txt"

dnstwist --registered --format json "$DOMAIN" | jq -r '.[].domain' | sort -u > "$TODAY"
# (check the JSON field names against your dnstwist version)

PREV=$(ls -1 "$DIR"/*.txt | sort | tail -n 2 | head -n 1)
if [ "$PREV" != "$TODAY" ]; then
  echo "New lookalike domains since last run:"
  comm -13 "$PREV" "$TODAY"
fi

0 6 * * * /home/analyst/lookalike-check.sh >> /home/analyst/dnstwist-monitor/alerts.log 2>&1

Responding to a lookalike

1. Investigate: Does it have a website? MX records? Does it copy your branding?
2. Block: add it to email gateway and web filter blocklists.
3. Report: send an abuse report to the registrar and hosting provider (use RDAP/WHOIS to find them); report phishing pages to browser safe-browsing services.
4. Warn: tell employees or customers if an active campaign is likely.
5. Prevent: consider defensively registering the most obvious typos of your domain.

Certificate Transparency (CT) Monitoring

Every publicly trusted TLS certificate is recorded in public CT logs (introduced in the intro lesson as a recon source). Defenders can watch the same logs for:
- Certificates issued for your domains that you didn’t request (a sign of compromise or misissuance)
- New subdomains created by other teams (shadow IT)
- Certificates for lookalike domains, which often appear shortly before a phishing campaign launches

Manual checks with crt.sh

• Search %.companyx.com to list certificates for all subdomains.
• Search for your brand name to catch certificates for lookalike domains.
• crt.sh can return JSON for scripting:
  

  curl -s "https://crt.sh/?q=%25.companyx.com&output=json" | jq -r '.[].name_value' | sort -u
  

Continuous monitoring with Cert Spotter

Cert Spotter (from SSLMate) watches CT logs and alerts you when a certificate is issued for your domains.
- Hosted service: alerts, a dashboard, and expiration monitoring (check current pricing).
- Open-source version: the certspotter command-line tool you can run yourself; it doesn’t require a database.

Brand Impersonation Monitoring

Attackers impersonate organizations and their people on platforms you don’t control:
- Fake executive profiles on LinkedIn and messaging apps, used for BEC and gift-card scams
- Fake support accounts on social media that reply to real customer complaints with phishing links
- Fake job postings and recruiters using the company name to scam job seekers or collect personal data
- Fake mobile apps and browser extensions
- Cloned login pages hosted on lookalike domains

How to monitor:
- Periodically search each major platform for your company name, logo, and executive names.
- Watch for new accounts with your brand name in their handle.
- Use verified accounts where platforms offer them, so customers can tell the real one apart.
- Know each platform’s impersonation reporting process before you need it.
- At scale, digital risk protection (DRP) vendors automate this and handle takedowns (several are listed in Module 6).

Dark Web and Stealer-Log Monitoring

Module 6 covers the dark web and threat intelligence platforms in depth. For defensive monitoring, the key options are:

Note: Google’s Dark Web Report was discontinued in February 2026.

Responding to a stealer-log hit

Stealer logs are more urgent than old breach data because they often include live session cookies that can bypass MFA.
1. Reset the affected passwords.
2. Revoke all active sessions and tokens for the affected accounts.
3. Find and reimage the infected device (it may be a personal device used for work).
4. Review logs for suspicious logins since the infection date.

Personal Monitoring

Individuals can set up a lightweight version:
- Google “Results about you”: alerts when new Google Search results show your phone number, home address, email, or (since 2026) government ID numbers.
- HIBP Notify me for each email address you use.
- Password manager breach alerts.
- Hudson Rock free account for your email and usernames.
- Google Alerts for your name.
- Calendar reminders to re-check data brokers every 3–6 months.

Building a Simple Monitoring Routine

Monitoring only works if someone actually looks at the alerts. Keep it simple and assign owners.

Organizational routine

Triage workflow

1. Validate: Is it real? Is it actually about us?
2. Assess: How bad is it, and how urgent?
3. Assign: Who owns the fix?
4. Act: Block, reset, report, remove, or warn.
5. Document: Record what happened and what was done (see Module 7).

Avoiding alert fatigue

• Tune keywords to cut noise (add context words, exclude common false positives).
• Route alerts to a shared mailbox or ticket queue, not one person’s inbox.
• Review the routine quarterly: drop alerts that never produce anything useful, add ones for new risks.

Key Terms

• Early warning: detecting signs of an attack or exposure before damage occurs.
• Typosquatting: registering misspelled or lookalike domains to deceive users.
• Homoglyph: a character that looks like another (such as rn and m).
• Certificate Transparency (CT): public logs of every publicly trusted TLS certificate.
• Digital risk protection (DRP): services that monitor for brand impersonation, leaks, and threats outside your network.
• Stealer log: data stolen by infostealer malware, often including passwords and session cookies.
• Alert fatigue: when too many low-value alerts cause important ones to be missed.

Key Takeaways

• Audits are snapshots; monitoring is the early-warning system.
• Free building blocks: Google Alerts, HIBP, Hudson Rock, Google “Results about you”.
• dnstwist finds registered lookalike domains; automate it and alert on new ones.
• CT logs reveal unauthorized certificates and lookalike domains before phishing campaigns launch.
• Stealer-log hits are urgent: reset passwords and revoke sessions.
• Monitoring only works with owners, a triage process, and tuned alerts.

References

• Have I Been Pwned: Find the Right Plan
• Have I Been Pwned Support: How do I verify my domain?
• Have I Been Pwned Support: Getting started with Domain Search monitoring
• dnstwist (GitHub)
• SSLMate: Cert Spotter
• SSLMate: certspotter (GitHub)
• Hudson Rock: Free Infostealer Monitoring
• SOCRadar: Free Dark Web Report
• Flare
• Google Search Help: Find and remove personal info in Google Search results
• The Hacker News: Google to Shut Down Dark Web Monitoring Tool in February 2026