dnstwist

dnstwist is a domain name permutation engine designed for detecting homograph phishing attacks, typosquatting, fraud and brand impersonation. It creates variations of a given domain name that look similar and queries DNS records including A, AAAA, NS and MX to identify potentially malicious domains.

For MX records, it specifically checks if there is an active mail server that could intercept misdirected emails, aiding in the detection of email phishing setups. The tool also evaluates webpage similarity using fuzzy hashes, providing insight into content mimicry used in phishing campaigns.

This functionality is particularly useful in cybersecurity investigations for proactive threat hunting against typosquatters and impersonators targeting brands.

dnstwist generates permutations of the input domain name using fuzzing algorithms to create visually similar domains. It then performs DNS queries for A, AAAA, NS, and MX records on these permutations. For MX records, it verifies active mail servers capable of intercepting emails. Webpage similarity is estimated using fuzzy hashes, with options for LSH algorithm. Additional features include HTTP/SMTP banner grabbing, GeoIP lookups, and customizable output formats.