← Guides

Check Domain Impersonation: Find Lookalike Attacks

2026-10-13 · 6 min read

Step 1 — Check your certificates

Query crt.sh for your domain and review every certificate. Anything issued by a CA you don't use, or for a subdomain you didn't create, is suspicious.

Step 2 — Check your CAA records

Run dig CAA yourdomain.com +short. No output means any CA may issue for you — publish CAA records immediately (see our CAA guide).

Step 3 — Hunt lookalikes

Generate typosquat permutations of your brand (omissions, transpositions, homoglyphs, combosquats, TLD-swaps) and check which resolve. Pay special attention to ones with MX records — they can intercept your email.

Step 4 — Inspect registered lookalikes

Visit each registered lookalike (safely — don't enter credentials). Password fields, your brand in the title, forms posting elsewhere: phishing-kit signals.

Step 5 — Report what you find

Follow the takedown ladder: registrar, hosting provider, Safe Browsing, SmartScreen, PhishTank, IC3.

Step 6 — Automate it

This checklist takes an afternoon the first time and should be repeated monthly. Or let DomainGuard run it continuously — Pro watches your domain and its lookalikes around the clock from $29/mo.