dnstwist
A domain permutation engine that finds lookalike domains used for typosquatting, phishing and impersonation.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About dnstwist
dnstwist takes your domain name and generates a large set of variations, such as typos, swapped characters and homoglyphs, then checks which of them are registered. The result shows lookalike domains that could be used for phishing, fraud or brand impersonation.
It is a Python program run from the command line, with a Dockerfile and a web application included in the repository. Security teams use it as an extra source of targeted threat intelligence about their own brand.
Strengths
- Detects typosquatting, homograph and impersonation domains
- Checks which permutations are actually registered
- Includes a Docker image and web app
- Bundled dictionaries for extra permutations
Limitations
- Needs network access for DNS lookups
- Output needs review to separate real threats from harmless registrations
Details
- Pricing
- FreeFree and open source.
- License
- Open source, license not stated
- Developer
- elceef
- Platforms
- Self-hosted, Command line
- How it runs
- Downloadable app, Self-hosted
- Account
- Not required
- Works offline
- No
- Best suited for
- Security teams monitoring lookalike domains that target their brand
- Categories
- Network tools, Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Similar software
Related functionality, not necessarily a direct replacement.
DNSDumpster
A web tool that discovers DNS records and hosts related to a domain for security research.
crt.sh
A free web search engine for certificates recorded in public Certificate Transparency logs.
Cert Spotter
A hosted Certificate Transparency monitor that alerts on unauthorized, expiring and invalid SSL certificates for your domains.
DNSRecon
A Python command-line script for DNS enumeration, record lookups, zone transfer checks and subdomain brute-forcing.
