Over the last year, we tracked how attackers impersonate startups using fake domains, Telegram groups, and lookalike social accounts. A few patterns we found: Phishing domains go live within hours of funding announcements Dark web chatter often precedes brand impersonation Most founders discover abuse only after customer complaints