elceef/dnstwist

dnstwist is a Python-based tool designed to detect domain name variants and typo-squatting attempts. It generates a comprehensive list of potential domain permutations—such as misspellings, homoglyphs, and character substitutions—that could be used for phishing, brand impersonation, or other malicious activities. The project serves as a security research utility for identifying lookalike domains that might be registered by adversaries to exploit user confusion or trust.

The tool systematically probes each generated domain variant to determine its registration status, DNS resolution, and other attributes, helping security professionals and brand owners proactively discover potential threats. It supports multiple mutation techniques, including character omission, repetition, replacement, and insertion, as well as internationalized domain name (IDN) homograph attacks. By automating the discovery of these domain variations, dnstwist enables users to monitor their digital footprint and take preemptive action against domain-based abuse.

The project is distributed as a command-line utility with straightforward installation via pip or direct source download, making it accessible for integration into security workflows and automated monitoring pipelines.