Domain Spoofing

Built a lightweight Wazuh Domain Impersonation Monitor that checks lookalike domains using DNS, Certificate Transparency, fuzzy matching, allowlists, and state tracking. Suspicious findings are written as JSON and sent into Wazuh for alerting, email, and dashboard visibility.