Playing Defense By Locating Pre-Attacks

This advisory explains how defenders can proactively detect and disrupt phishing/BEC campaigns by discovering adversary pre-attack infrastructure—primarily typo-squatted domains and fake TLS certificates—using tools like DNS Twist to generate domain permutations and Censys to search certificate transparency logs; it includes examples (Anthem, Binance) and recommends takedowns and blocking to prevent attacks.