In some implementations, a method includes receiving an input domain name and generating a normalized domain name based on the input domain name. The normalized domain name including at least one of an internationalized domain name (IDNA) or a Unicode domain name that is converted from puny code characters in the input domain name. The method also includes determining whether the input domain name is excluded from domain impersonation analysis based on the normalized domain name and risk configuration data associated with an entity. In the event that the input domain name is not excluded from domain impersonation analysis, the method further includes calculating a confidence score representing a risk of domain impersonation to the entity, calculating the confidence score including at least one of: i) analyzing a typo-squat in the input domain name; or ii) analyzing a combo-squat in the input domain name.