elceef/dnstwist
Dnstwist
dnstwist is a Python-based tool designed to detect domain name variants and typo-squatting attempts. It generates a comprehensive list of potential domain permutations—such as misspellings, homoglyphs, and character substitutions—that could be used for phishing, brand impersonation, or other malicious activities. The project serves as a security research utility for identifying lookalike domains that might be registered by adversaries to exploit user confusion or trust.
The tool systematically probes each generated domain variant to determine its registration status, DNS resolution, and other attributes, helping security professionals and brand owners proactively discover potential threats. It supports multiple mutation techniques, including character omission, repetition, replacement, and insertion, as well as internationalized domain name (IDN) homograph attacks. By automating the discovery of these domain variations, dnstwist enables users to monitor their digital footprint and take preemptive action against domain-based abuse.
The project is distributed as a command-line utility with straightforward installation via pip or direct source download, making it accessible for integration into security workflows and automated monitoring pipelines.
Features
- Command Line Tools - Listed in the “Command Line Tools” section of the The Book Of Secret Knowledge awesome list.
- Domain and IP Investigation - Detects phishing domains and monitors DNS changes.
- Forensic Analysis Tools - Tool for detecting typosquatting and domain-based intelligence.
- DNS Security - Detects typosquatting, phishing, and brand impersonation.
- Domain Analysis - Detects typo-squatting and phishing via domain permutation.
- Network Security Tools - Domain permutation engine for detecting typo-squatting and phishing.
- Social Engineering - Phishing domain generation and lookup.
