Domain impersonation monitoring
Someone could be wearing your domain name right now.
Hackers forged valid TLS certificates for Google. In March 2026, one lookalike domain (surfsidesbeach.org) cost the town of Surfside Beach $545,598. DomainGuard watches Certificate Transparency logs, typosquat domains, and your CAA posture — and alerts you the moment anyone impersonates your domain.
Free for $0/mo · No credit card · 2-minute setup
What is DomainGuard? DomainGuard is a domain impersonation monitoring service: it watches Certificate Transparency logs for rogue certificates issued in your name, scans for typosquat and lookalike domains targeting your brand, and checks your CAA DNS posture — alerting you the moment anyone impersonates your domain.
Three ways attackers impersonate you. One dashboard that catches all three.
Rogue certificates
We poll Certificate Transparency logs continuously. The moment any certificate is issued for your domain — by any authority — you know. It's the same technique Google publicly recommends every domain owner use.
Typosquat phishing domains
We generate thousands of lookalike permutations (typos, homoglyphs, combosquats, TLD-swaps) and check which are actually registered — including ones with rogue MX records that can intercept your email. Registered lookalikes get scanned for phishing-kit indicators.
Weak DNS posture
No CAA record? Any certificate authority on earth may issue for your domain. We check your CAA posture and hand you the exact two lines of DNS that close the hole — then confirm when they're live.
Before DomainGuard / After DomainGuard
Before
- You find out about the phishing site when a customer complains — or never.
- Certificate issuance happens silently; rogue certs live for months.
- Lookalike domains multiply; the $545,598 invoice goes to the wrong "you".
- Takedown means Googling "how to report a phishing domain" at 2am.
After
- Instant alert the moment a certificate is issued for your domain.
- Daily watch on thousands of typosquat permutations — registered ones flagged automatically.
- CAA posture fixed with the exact DNS records, verified live.
- One-click takedown packets: registrar abuse, Safe Browsing, PhishTank, IC3 — pre-written.
How it works
- Enter your domain. That's the whole setup — no agents, no DNS changes, no code.
- We scan your exposure. Certificate history, registered lookalikes, CAA posture — in one report.
- We keep watch. Continuous CT polling and typosquat sweeps. New findings land in your inbox with takedown steps.
Honest note: our detection is rule-based and heuristic — we check public Certificate Transparency logs, DNS records, and page content. We never claim to catch everything; cloaked phishing kits can hide from any scanner. Every alert explains exactly what we saw and how we saw it.
Find out who's wearing your name — free.
One domain. Certificate history, registered lookalikes, CAA posture. No credit card.
Run my free reportFrequently asked questions
What is DomainGuard?
DomainGuard is a domain impersonation monitoring service for small businesses. It watches Certificate Transparency logs for rogue certificates issued in your name, scans thousands of typosquat and lookalike domains targeting your brand, and checks your CAA DNS posture — alerting you the moment anyone impersonates your domain.
What is domain impersonation?
Domain impersonation is when attackers register lookalike domains (typosquats like yourbrand-login.com) or obtain certificates for your name, then use them to phish your customers. In March 2026, one extra letter in a lookalike domain cost the town of Surfside Beach, SC $545,598 — documented by the Cloud Security Alliance.
How does DomainGuard detect impersonation?
Three ways: (1) we poll Certificate Transparency logs so you're alerted the moment any certificate is issued for your domain — the same technique Google publicly recommends; (2) we generate thousands of typosquat permutations and check which are actually registered; (3) we check your CAA DNS posture and scan registered lookalikes for phishing-kit indicators.
What is a CAA record and why does it matter?
A CAA DNS record tells the world which certificate authorities are allowed to issue certificates for your domain. Without one, any CA can issue. Publishing two lines of DNS stops most rogue issuance — we check yours and give you the exact records to add.
What do I do when DomainGuard finds a phishing domain?
Every finding ships with a takedown packet: registrar abuse contact, hosting provider abuse, Google Safe Browsing and Microsoft SmartScreen report links, PhishTank, and IC3. Follow the packet and most phishing domains come down in hours to days.
Is the free report really free?
Yes. For $0/mo you get a one-time impersonation exposure report for one domain: certificate history, registered lookalikes found, and your CAA posture. No credit card. Continuous monitoring with instant alerts is Pro ($29/mo).
What if I want a refund?
One-click refund, no questions asked. Reply to any email or use the billing page within 30 days: your license key is revoked and your payment refunded the same day.