robcza / dnstwist

Domain name permutation engine for detecting typo squatting, phishing and corporate espionage

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find similar-looking domains that adversaries can use to attack you. Can detect fraud, phishing attacks and corporate espionage. Useful as an additional source of targeted threat intelligence.

Demo

Screenshot

You are also welcome to see some example reports.

Features

There are several good reasons to give it a try:

  • Wide range of domain fuzzing algorithms
  • Resolving domain names to IPv4 and IPv6
  • Querying for NS and MX records
  • Optional: Evaluating web page similarity with fuzzy hashes
  • Optional: GeoIP location information
  • Optional: Banner grabbing for HTTP and SMTP services
  • Optional: WHOIS lookups for creation and modification date
  • Optional: Output in CSV format

Required modules

If you want dnstwist to develop full power, please make sure the following Python modules are present on your system. If missing, dnstwist will still work, but without many cool features.

If running Ubuntu or Debian, you can install dependencies like this:

$ sudo apt-get install python-dnspython python-geoip python-whois python-requests

Installation of ssdeep module requires a little more effort:

$ sudo apt-get install build-essential libffi-dev python python-dev python-pip automake autoconf libtool

$ sudo BUILD_LIB=1 pip install ssdeep

Contact

To send questions, comments or a chocolate, just drop an e-mail at marcin@ulikowski.pl

Special thanks

  • Patricia Lipp
  • Steve Steiner
  • Christopher Schmidt
  • James Lane
  • Piotr Chmyłkowski
  • Eugene Kogan

About

Domain name permutation engine for detecting typo squatting, phishing and corporate espionage


Languages

Language:Python 100.0%