Domain Impersonation Defense Cheat Sheet — what is phishing infrastructure, and how to spot it early
— Ingenious AI security checks.
Direct answer: Domain impersonation is how most phishing starts: a lookalike domain that mimics your brand to host a fake login page or send scam email. This cheat sheet is for brand owners, IT leads and anyone whose customers log in online. DomainGuard hunts lookalikes continuously (Free scan, Pro $29/mo, Team $79/mo), and its free scan checks your brand across certificate logs today.
Key facts
There are 7 typosquat families (next section) — attackers register combinations of all of them before a campaign launches.
Every lookalike leaves a public trace: certificate transparency logs record new certificates for lookalike domains, usually days before the phishing emails go out.
Email authentication is the second wall: SPF, DKIM and a DMARC policy at enforcement (p=reject) decide whether a lookalike can spoof your exact domain.
What is phishing infrastructure?
Phishing infrastructure is the plumbing behind a phishing campaign: the lookalike domain, its TLS certificate, the cloned login page and the mail setup that delivers the lure. The domain is registered first and is the earliest observable signal — often days before a single victim receives a message.
What are the 7 typosquat families?
1. Letter swap: two characters exchanged (acme becomes acme spelled with swapped neighbours, e.g. acem).
2. Omission: one letter dropped (acme becomes ame-style shortenings of your exact brand).
3. Addition: a letter or word added — acme-secure, acme-login, acme-support.
4. Hyphen tricks: hyphens inserted between words or before trust words like verify, account or billing.
5. TLD swap: your name on a different ending — .net, .io, .co, .app or a country code.
6. Homographs: lookalike Unicode characters (a Cyrillic 'a' for a Latin 'a') that render identically in the browser.
7. Combosquats and subdomains: your brand inside a longer domain, or as a subdomain of an unrelated registered domain.
How do you monitor for lookalikes?
Search certificate transparency logs for your brand string and scan for anything you do not recognise — unfamiliar lookalikes with fresh certificates are the top investigate-now signal.
Check the classic variants by hand weekly: hyphen forms, letter swaps, TLD swaps and trust-word additions.
Verify your own email authentication: publish SPF and DKIM, then move DMARC from monitoring (p=none) to enforcement (p=quarantine, then p=reject).
Publish a CAA record so only your chosen certificate authorities can issue certificates for your real domain.
On a confirmed squat: do not visit it from a work machine; document screenshots, WHOIS and certificate dates; file registrar abuse reports and a Google Safe Browsing phishing report; warn customers through a channel you control.
Phishing is a fraud where attackers impersonate a trusted brand or person to trick victims into entering credentials, approving payments or installing malware. Most phishing runs on impersonation infrastructure: a lookalike domain, a cloned page and lure messages that point victims at it.
What is typosquatting?
Typosquatting is registering domain names that look like a trusted brand — swapped or dropped letters, added hyphens, trust words like login or secure, lookalike Unicode characters, or the same name on a different TLD. The lookalike then hosts a phishing page or sends scam email that victims mistake for the real brand.
What is the DMARC gap check?
The gap check verifies whether your domain's email authentication would actually stop a spoof. You need SPF and DKIM published and aligned, plus a DMARC policy at enforcement. A DMARC record stuck at p=none only watches; p=quarantine or p=reject is what makes receiving servers block or junk the fakes.
What does DomainGuard cost?
DomainGuard starts with a free scan of your brand across certificate transparency logs. Pro is $29 per month for continuous monitoring and alerts, and Team is $79 per month for more brands and seats. The free scan shows which lookalikes already exist before you commit to monitoring.