Free cheat sheet · PDF download · No signup

Domain Impersonation Defense Cheat Sheet

October 2026 · v1.0 · reviewed quarterly · By the DomainGuard team

The short version

Attackers don't hack your site — they clone your domain. A typosquat, a homoglyph, your name on another TLD, a fake subdomain: each one is a phishing site, a BEC mailbox, or a traffic thief waiting to happen. In a documented 2026 incident, a single typosquatted letter cost the town of Surfside Beach $545,598 (Cloud Security Alliance, October 2026). This sheet is the complete one-page defense playbook. The checks take minutes; we run them continuously for you.

1 · The 7 typosquat families

• Homoglyph — lookalike Unicode characters: Cyrillic а for Latin a, rn for m. Example: pаypal.com
• Bitsquat — one flipped bit in a letter; catches misdirected DNS lookups from faulty hardware memory. Example: bacebook.com
• Combosquat — your name plus a trusted word: secure, login, support, invoice. Example: secure-yourbrand.com
• Hyphenation — a hyphen added or dropped where yours has none. Example: your-brand.com
• TLD-squat — your exact name on another ending. Example: yourbrand.co (.co .cm .io .net)
• Subdomain-spoof — your brand placed left of an attacker-owned domain. Example: yourbrand.evil.com
• Omitted dot — the dot dropped, www. fused into the name. Example: wwwyourbrand.com

2 · Certificate Transparency monitoring

Certificate Transparency (CT) logs are public records of every TLS certificate issued on the internet. Anyone can request a certificate for your domain — the log is where you find out. In October 2026, reports described hackers forging valid TLS certificates for Google domains (The Register, October 7), and Google publicly recommends that all domain owners monitor CT logs.

Free 10-second check: search your domain on crt.sh. A certificate you didn't request is a red flag.

3 · CAA records — the 2-minute fix

A CAA record is a DNS entry listing which Certificate Authorities may issue certificates for your domain. No CAA record means any CA in the world can issue one.

Setup: add a CAA record at your DNS host, e.g. 0 issue "letsencrypt.org" (add 0 issuewild too if you use wildcard certificates).

4 · DMARC / SPF / DKIM — the gap check

The 1-line check: look up the TXT record at _dmarc.yourdomain.com. No record means anyone can send email as your domain and receiving servers can't tell the difference.

Fix path: publish SPF and DKIM, then DMARC starting at p=none — tighten to p=reject.

5 · Early warnings most owners miss

BEC early warning. MX records say where a domain receives email. A lookalike publishing MX records means someone set up mailboxes there — usually the first step before a CEO-fraud or invoice email goes out "as" your company. Lookalike + MX records = investigate today, before the wire request arrives.

Canary subdomains — the tripwire. Plant a fake subdomain that should never exist (e.g. billing-verify-9f3.yourdomain.com) and watch CT logs for it. Nobody legitimate ever requests a certificate for a subdomain only you know about — any cert issued for it means you are being targeted right now. Silent, free, and genuinely novel.

6 · Takedown: the 3-report playbook

1. Registrar abuse report. Look up the fake domain's registrar via WHOIS/RDAP and report to their abuse contact with screenshots of the impersonation.
2. Host abuse report. Find where the site is hosted (IP lookup) and file with the hosting provider's abuse desk — hosts suspend phishing pages fast.
3. Browser blocklists. Report the URL to Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish/) so Chrome, Firefox, and Safari warn visitors.

Also file with Microsoft SmartScreen and PhishTank — and consider defensively registering your highest-risk variants. A few dollars a year beats a dispute.

7 · The 60-second self-check

• crt.sh → search your domain. A certificate you didn't request? Investigate.
• CAA: dig CAA yourdomain.com. Empty? Any CA can issue for you.
• DMARC: TXT record at _dmarc.yourdomain.com. None? You're spoofable.
• Dot test: visit wwwyourdomain.com. Not yours? Watch it.
• TLD test: check .co .cm .io .net versions of your name. Registered = risk.
• MX test: a lookalike with MX records can email as you.

Frequently asked questions

What is domain impersonation?

Domain impersonation is when an attacker registers a lookalike of your domain — a typosquat, a homoglyph, your name on another TLD — and uses it to phish your customers, send email as your company, or intercept your traffic.

What is Certificate Transparency (CT) monitoring?

Certificate Transparency logs are public records of every TLS certificate issued on the internet. Monitoring them means you are alerted the moment any certificate is issued for your domain — including ones you never requested. Google publicly recommends all domain owners do this.

What does a CAA record do?

A CAA record is a DNS entry listing which Certificate Authorities are allowed to issue certificates for your domain. Without one, any CA in the world can issue a certificate for it. Adding one (for example: 0 issue "letsencrypt.org") takes about two minutes at your DNS host.

How do I check whether my domain can be spoofed by email?

Look up the TXT record at _dmarc.yourdomain.com. If no DMARC record exists, anyone can send email as your domain and receiving servers cannot tell the difference. Publish SPF and DKIM first, then DMARC starting at p=none and tighten to p=reject.

What is a canary subdomain?

A fake subdomain that should never legitimately exist (for example billing-verify-9f3.yourdomain.com), watched via Certificate Transparency logs. Any certificate issued for it means someone is actively targeting you — a silent tripwire that costs nothing to run.

How do I take down a phishing domain impersonating my brand?

Report through three channels at once: (1) the registrar's abuse contact (find it via WHOIS/RDAP), (2) the hosting provider's abuse desk (find the host via IP lookup), and (3) Google Safe Browsing at safebrowsing.google.com/safebrowsing/report_phish/ so browsers warn visitors.