01 · Product name
dnstwist
Generates lookalike domains and shows which ones are registered.
Published by Marcin Ulikowski.
In short
dnstwist is a free domain-permutation tool by Marcin Ulikowski, licensed Apache-2.0. It builds lookalike names for a domain you supply and checks which of those names resolve. The README documents dnstwist --registered for names that are actually in DNS, and it points at a browser version at dnstwist.it. A registered lookalike is a lead. It is not proof of phishing, and an unregistered permutation is only a name the fuzzer invented. The browser page opened here did not show a result table, so the evidence is the command line.
Product pricing strategy
02
Free
dnstwist is free. The repository is Apache-2.0, and the README's install paths are pip, a local checkout, and a Docker image. The browser page at dnstwist.it does not show a price, a seat, or a credit pack. There is nothing to subscribe to in the pages opened for this listing. DNS lookups are your resolver's traffic. If you add the README's page-hash or screenshot options, that is extra fetching of the lookalike sites, still without a vendor fee attached. This listing does not quote a price because the project does not publish one.
Utility and features
03
dnstwist fuzzes a domain. The README describes algorithms for homoglyphs, bits missing, bits swapped, and dictionary additions, then DNS checks that throw away names nobody has registered. The command it documents for that second step is dnstwist --registered. Output can be a table, a list, CSV, or JSON. The README also describes fuzzy hashes and screenshots of web pages. Those are extra steps. A registered name does not need them to be worth reading.
- Permutations, then DNS. The fuzzer invents names. --registered keeps the ones that answer DNS. An empty DNS answer is a name that was not registered in that run.
- Several output formats. The README documents CLI, list, CSV, and JSON. Keep the format with the date. A later run can print a different address for the same name.
- Registration is not intent. A lookalike that resolves can be a parked page, a real organization, or a malicious site. Open it only when policy allows, and say which it was.
Two local runs against owasp.org, both with --registered, each returned 13 rows. The CLI table included the original name plus homoglyph 0wasp.org, omissions such as oasp.org and wasp.org, and other registered permutations. The JSON run returned the same fuzzer labels and the same lookalike domains. The address printed for the original name differed between the two runs, so quote the file you saved, not a remembered IP. dnstwist.it opened as a short page with a scan control and a link to the source. It did not display this result set. Use the command when you need the rows.
- 1
Install from the repository README. Confirm dnstwist --help shows --registered.
- 2
Run dnstwist --registered against a brand domain you are allowed to monitor. Save the table.
- 3
Read the fuzzer column. Separate the original row from homoglyphs, omissions, and swaps.
- 4
Re-run later and diff the names. Do not assume an address from the first file is still current.
Caveats
04
A registered permutation is not a campaign. People and companies register short names, dictionary words, and typos that collide with a brand. The original row is the domain you typed, not a lookalike. Addresses change between runs, which the two owasp.org files demonstrated.
The README also offers page hashes and screenshots. Those fetch the lookalike sites. Do not add them because the switch exists. An unregistered name is not a threat and not a domain you should try to claim from inside this tool. Pair a name you will cite with urlscan or a browser you are allowed to use, and record the date.
Screenshots
05
Potential use cases
06
- A brand owner wants to know which lookalike domains are registered, not which strings the fuzzer can invent. Run dnstwist --registered against the brand domain and keep the fuzzer column. The owasp.org runs returned 13 rows, including homoglyphs and omissions that answered DNS. Hand a name you will actually open to urlscan, and only if policy allows the fetch. A parked page and a phishing page both register.
- Two runs disagree on the address of the original domain. That happened between the CLI table and the JSON run for owasp.org. Keep both files and the commands. Quote the file. Do not average the addresses. Re-resolve the name if the decision depends on where it points today. The lookalike domains were the stable part of those two outputs.
- A stakeholder wants the browser version instead of the command. dnstwist.it opened as a scan control and a source link, without this result table. Use the CLI when you need the rows. The README documents the same --registered switch the local runs used. A screenshot of the empty browser page is not the finding.
Hard cases
The case where the first result is easy to over-read.
The homoglyph is a real company's site
The fuzzer marks a name as a homoglyph or an omission and DNS answers. The site at that name may be unrelated and legitimate. Do not send a takedown from the fuzzer label. Open the page if you are allowed to, read who it says it is, and check the registration separately. If it is a collision, record the collision. If it is malicious, the evidence is the page and the DNS, not the fact that dnstwist invented the string.
Questions
Is dnstwist free?
Yes. It is Apache-2.0 software. The README and dnstwist.it do not sell a plan.
Does a registered lookalike mean someone is phishing?
No. It means DNS answered for a name the fuzzer derived. Parked domains and unrelated organizations show up the same way. Content and intent are a second check.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
dnstwist browser
https://dnstwist.it/Documentation
dnstwist repository
https://github.com/elceef/dnstwistDocumentation
dnstwist README
https://github.com/elceef/dnstwist/blob/master/docs/README.md