AI-Powered Attacks – Fake Emails and Bot Scrapers Targeting Real Estate Websites, and How To Combat It
We became aware of two fast-growing, AI-powered threats currently targeting the real estate industry. Here’s what our clients (And Others) should be wary of.
AI has brought real, measurable benefits to real estate marketing. Brixwork has been using AI-powered web development workflows to significantly cut down production costs, and more home buyers than ever are turning to Claude, Gemini, Perplexity to look for a Realtor®, creating new lead gen channels for eager agents.
And, as usual, there are always the bad people who abuse and steal. We’ve been notified of scammers impersonating our team members, and stealing intellectual property — trying to find shortcuts around achievements that took us several years to build. Here are two major mis-uses of AI that our clients ought to be aware of (if you care about online safety and protecting what’s yours, that is).
Two Malicious Uses of AI That Brixwork Realtors® Should Be Aware Of
From impersonation emails to aggressive data harvesting, here is what Brixwork has identified and what is being done to fight back.
Fake “Jeff Kee” Emails
AI-generated emails impersonating Brixwork’s founder to dupe you.
Bot Scraping Surge
High-volume AI bot traffic data-mining our real estate websites for SEO steal.
Brixwork Is Fighting Back
SPF records for authentication, and evolving firewall rules to protect our clients.
A Sophisticated Con – Using AI to Impersonate Jeff Kee By Email
Fake emails have been around forever, but this one is different. We’ve identified a wave of spam emails impersonating founder and director Jeff Kee, sent from jeff.brixwork@gmail.com instead of our own ___@brixwork.com addresses. Not only that, these emails contain jargon and phrases we often discuss with our clients. Generic SEO scams that open with “Our audit of your website found problems” is easy to spot from 5km away. These ones sounded more believable, complete with an email signature with Jeff’s mugshot on it.
How Is AI Making These Scam Emails So Convincing to Our Realtors®?
Using AI, the people behind these emails appear to have studied and emulated Jeff’s actual written communication style. Brixwork suspects the process works like this:
- Gather the source material. Jeff’s writing is not hard to find: our own blog posts, his personal posts on jeffkee.com, his LinkedIn posts on web development and SEO, and even previous Mailchimp email campaigns — many of which are publicly accessible for your convenience — all provide easy reference material for AI tools to mimic.
- Feed it to AI writing tools. AI writing tools can study that material in bulk and learn the tone, phrasing, and structure. It also referenced our industry jargon, commonly discussed topics (such as how MLS® Reciprocity is critical for SEO on Realtor® websites).
- Generate the email templates. The resulting emails does a pretty decent job imitating Jeff’s tone, complete with his name and photo in the signature, branded with the Brixwork logo — familiarity designed specifically to make a longtime client lower their guard, a classic con-artist’s ploy.
How Are They Targeting Existing Clients — Did Brixwork Leak Their Contact List?
This is not a random, mass-blasted scam. Brixwork has found that these emails are being sent to existing Brixwork clients. No, we did not have a security breach where we leaked email addresses of our clients. This points to a more deliberate, AI-assisted targeting process:
- The Real Estate Websites get scraped. The scammers appear to be using AI to scrape the very real estate websites Brixwork has built. Our websites are designed to be easy to find on Google™, obviously.
- The contact info gets harvested. Agent contact information is lifted directly from those pages — our job is to make it easy for your potential clients to find our Realtors® we serve.
- The target list gets built. That public contact list then becomes the target list — which is why these emails land with existing Brixwork clients instead of random inboxes.
- The emails are tailored to each client AI is best at rearranging words (that’s what LLMs are, fundamentally), so generating personalized emails to each one with a convincing subject and email body is easy.
From there, the scammers appeared to have created a new Gmail account at jeff.brixwork@gmail.com, and sent out dozens of emails, each tailored to the intended target, over the course of a few days. Many spotted the fake right away, and have alerted us of it going around.
The Obvious Tells of a Scam Email, And How We Protect You Against Identity Theft
Despite the efforts to impersonate a real Brixwork staffer, this scam had many tells of a scam email. A few quick checks expose almost every fake:
- The easiest tell that exposes this fake: We will never send emails from anywhere other than our own domain, ___@brixwork.com. If it’s not from a ___@brixwork.com email address, it’s not us.
- A familiar name and photo prove nothing. The scammers use Jeff’s real name and photo on purpose — the familiar face is the bait, not proof of legitimacy. Clients who paid attention noticed the signature design was different from the norm.
- Immediately Listing Prices Is A Red Flag. These fake emails exist to solicit money. We normally can’t give a price right away without a consultation since every job is unique, and our custom quotes need a consult and a review. We also won’t send a payment request without an official invoice.
- Watch for sketchy “SEO contractors” on personal email accounts. Be wary of contractors who rotate through personal Gmail addresses — Brixwork has been a reputable, established agency for almost two decades, and there is no scenario where it would suddenly start sending from a free Gmail or Hotmail account.
What Is Brixwork Doing to Protect Against Impersonation Phishing Emails?
Brixwork has set up solid SPF records — a critical security protocol for domains that lists servers and platforms explicitly authorized to send email on behalf of brixwork.com. This means any email faking the ___@brixwork.com source will end up in spam folders 99.9% of the time. This forced the scammers to use a ___@gmail.com account, making it very easy to catch as a scam.
This security procedure for domains are also applied to our clients’ own domains as well, which allows for seamless, secure email marketing campaigns without opening the door to impersonation.
Warning: AI Bots Are Scraping Brixwork Websites at an Alarming Rate
Past few months, we also identified a rise of scraping activity from AI bots (especially Claude), indicating that competitors or other agencies are be using AI-powered utilities to scrape website content and gather intel on website structure in order to replicate the success of some of our most high-ranking, best-performing real estate websites.
Isn’t It Normal for AI to Crawl Websites?
Yes, and we welcome it. After all, our clients are cited and recommended by AI engines. Regular crawls by Claude, Perplexity, ChatGPT, and Gemini are completely normal — we engineered it to be so. Well-SEO’d websites get cited and recommended by AI (aka GEO) so we will never prohibit AI bots from reading our client websites (even though that’s how they orchestrated the email scam mentioned above).
However, our engineering team noticed excessive and abusive scrapes from Claude data centres specifically — the kind of volume that suggests somebody is deliberately directing Claude to scrape real estate websites at scale.
The “Let AI Run Your SEO” Hype Is Fueling This Problem
We’ve all seen the hype on Instagram and Youtube by these showboaters trying to get views: “Let Claude run your entire SEO for you!” or “Build a website with Claude in just hours/minutes!” These claims are nonsense of course, as it takes more than a few web pages to actually be valuable to Google™, but the haphazard automations spun up around this hype are exactly what is driving hundreds of requests per minute against real estate websites — a browsing pattern completely different from a legitimate AI citation or recommendation served to someone actually looking for a Realtor® or insight on local real estate markets.
Our Websites Are Targeted Heavily Because They Want To Learn From The Best
We noticed the scrapers focus on the high-ranking, best-SEO’d websites among the Brixwork network — the ones performing the best (although they do cascade to websites of all scales). In a way it’s a compliment to our work, and the power of our CMS (content management system).
What Are They Trying To Steal From Our Real Estate Websites?
- Content on websites, especially community and neighbourhood info pages.
- Blog posts written by our clients, as well as Brixwork – custom written content is a top-notch SEO asset
- MLS® IDX data and structure – critical for geographic keyword ranking in real estate.
Server load increase over the past month on our Cloud Server.
This is a huge problem for us, and our clients: this swarm of bot-scrapes slows down servers due to overload, and it prevents real customers and legitimate search bots from reliably reading Brixwork clients’ real estate websites. Brixwork, like most capable network administrators, blocks this traffic — which is also exactly why the “automate your SEO with AI” hype falls apart under scrutiny.
How Brixwork Is Protecting Client Websites And Our Cloud Servers From Scrapers
Significant effort has gone into combating this over the past several months. We’ve deployed sophisticated firewall rules tailored specifically to our website structure and how MLS® listings are presented, along with multiple layers of filtering that keep malicious bots and crawlers out — all while still allowing clients to manage their own website content without any hiccups, and keeping websites fully visible to potential customers and to legitimate search engine and AI scrapers.
Remaining Vigilant Together Is The Key – Staying Informed And Alert
As an established SaaS-plus-boutique-design hybrid agency, we are putting tremendous effort for security and safety. Our engineering team is constantly working to identify and thwart bot threats on our website and server, while keeping legitimate traffic flowing well. While we cannot stop bad actors from creating fake email addresses and sending phishing emails to our clients, we send out frequent communications to alert and educate our clients of what to look out for. Stay vigilant. Be well-informed.
Think You’ve Received a Suspicious Email From “Brixwork”?
If any email claiming to be from Jeff Kee or Brixwork did not come from a brixwork.com address, do not respond or send money — Instead, get a hold of us directly for any website upgrades or new campaigns you wish to launch.
