Tenant portals, listing sites, and transaction platforms are high-value targets. Scan them.

Real estate runs almost entirely on public-facing software, most of it bought rather than built. A typical brokerage, property-management firm, or title company exposes a WordPress or CMS site loaded with IDX/MLS listing plugins, a tenant or owner portal (Yardi, AppFolio, Buildium, RealPage and similar), an agent login, a document-signing and transaction-coordination workflow, and a long tail of campaign microsites and old listing subdomains nobody maintains. Each of these is an internet-reachable asset with its own certificate, DNS records, open ports, and dependency stack — and most are administered by people whose job is selling or managing property, not security. That gap between a large external footprint and zero dedicated security staff is the defining characteristic of the sector.

The data behind those logins is unusually rich for fraud: lease and purchase agreements, bank account and routing numbers, Social Security numbers and copies of IDs from rental applications, tenant payment cards, and wiring instructions for closings. Real estate and title/escrow firms are among the most-targeted victims of business email compromise and wire fraud precisely because a single closing moves six or seven figures and the parties expect last-minute payment-instruction emails. The external openings that enable this are concrete and scannable: an exposed admin panel or unpatched CVE on a portal, a brokerage email domain with no SPF/DKIM/DMARC (so a spoofed 'updated wire instructions' message sails through), and lookalike domains registered to impersonate the firm or its title partner.

The other recurring exposure is misconfiguration left behind by fast growth and many vendors. Listing photos, floor plans, scanned applications, and document backups routinely end up in public S3/GCS/Azure buckets. Decommissioned listing or campaign subdomains point at SaaS hosts that have been torn down, leaving a clean subdomain-takeover path on the firm's own brand. Self-hosted listing sites accumulate exposed .env files, .git directories, and database backups; expired or weak TLS sits on payment and portal endpoints. None of this is exotic — it is the ordinary residue of a marketing-driven industry with a big web presence, and all of it is visible from the outside, which is exactly where FortWatch looks. External scanning will not see inside your PMS database or replace a pentest of custom transaction logic, but it reliably finds the exposed, misconfigured, and impersonating assets that attackers find first.