Key facts
- Criminals used 79 dormant domains owned by The Ashton Real Estate Group to impersonate the firm.
- The unauthorized emails originated from IP addresses in countries including China and Russia.
- The Ashton Real Estate Group reported nearly $710 million in volume across 1,324 transactions in 2025.
- Domain spoofing allows criminals to impersonate businesses without needing access to their email accounts.
- Implementing email security protocols reduced unauthorized messages by over 80% for the affected domains.
- Real estate transactions are attractive targets for scams due to large sums of money transferred at closing.
Criminals exploited 79 dormant website domains owned by The Ashton Real Estate Group to impersonate the firm and send fraudulent emails, posing a significant security risk to clients and their finances. Gary Ashton, founder of the real estate group, discovered the issue after engaging Alex Shakhov, founder of SH Consulting, to improve email performance.
Ashton had accumulated approximately 400 domains over the years for various purposes, many of which sat unused. Shakhov's investigation revealed that 79 of these dormant domains were being used to spoof the organization, sending emails that appeared to originate from Ashton's team without their knowledge. These messages failed email authentication checks and were traced to IP addresses in multiple countries, including China and Russia.
Domain spoofing allows criminals to impersonate a business without needing to breach its email accounts. While the exact content of the fraudulent messages and whether they reached clients could not be confirmed, Shakhov noted that similar schemes commonly involve phishing, fraudulent invoices, and requests for wire transfers. Real estate transactions are particularly vulnerable due to the large sums of money involved and the availability of public property information.
Following the implementation of email security measures by Shakhov, reports of unauthorized messages dropped significantly, from 235 in the five weeks prior to enforcement to 43 in the subsequent five weeks. The implemented protections help email providers identify and block fake messages before they reach inboxes, thereby securing the brokerage's reputation and ensuring legitimate communications are delivered.
The FBI's 2025 Internet Crime Report highlighted the prevalence of real estate fraud, with 12,368 complaints and approximately $275.1 million in reported losses. Business email compromise schemes accounted for even larger losses.