openSquat detects look-alike domains that resemble an organization’s legitimate domains, helping identify possible impersonation.
Open source
12 alternativesDnstwist
DNSTwist detects lookalike domains used in homograph phishing, typosquatting, and brand impersonation.
About Dnstwist
DNSTwist is an open-source domain permutation engine built to detect homograph phishing, typosquatting, and brand impersonation. It generates large sets of potential lookalike domains from a user-provided domain name, then verifies which of those permutations are registered and active. The tool also includes features for identifying live phishing pages via HTML and screenshot similarity, detecting rogue MX hosts that could intercept misdirected emails, and approximating the geographic location of associated IPv4 addresses. For longer input domains, thousands of permutations may be generated, requiring users to filter for registered domains or configure a DNS server capable of handling high volumes of requests; GeoIP functionality requires a GeoLite2 database to be specified via the $GEOLITE2_MMDB environment variable, or it will fall back to the legacy GeoIP library.
Key features
- Generates domain permutations to detect typosquatting and homograph domains
- Supports Unicode (IDN) domain name processing
- Accepts custom dictionary files for additional domain permutations
- Multithreaded task distribution for efficient processing
- Detects live phishing pages via HTML and screenshot similarity
- Identifies rogue MX hosts to flag misdirected email interception
Best for: Security teams and domain owners seeking to identify lookalike domains used for phishing, typosquatting, and brand impersonation attacks.
Good for
- Open-source with publicly accessible code repository
- Uses a variety of domain fuzzing algorithms for broad coverage
- Supports multiple installation methods including pip, Docker, and system packages
Watch out for
- Generates thousands of permutations for longer input domains, requiring filtering
- Requires a DNS server capable of handling high request volumes or manual nameserver configuration
- GeoIP functionality requires a separate GeoLite2 database to be specified, or falls back to legacy software
Dnstwist at a glance
- Website
- github.com/elceef/dnstwist
- Category
- Privacy & Security › Website & URL Scanners
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Yes · Source code
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Dnstwist alternatives
Tools and sites you could use instead, ranked by how closely they match.
isMalicious checks IP addresses, domains, URLs, emails, phone numbers, and cryptocurrency wallets against threat intelligence data.
Freemium
23 alternatives
Validin provides a community platform for threat intelligence teams to research and share security information.
Enumerate available domains generated modifying the original domain name through different cybersquatting techniques
Open source
6 alternatives
Discover subdomains and review DNS history through the Columbus subdomain discovery service.
Open sourcePick
7 alternativesDNSTwist scans for lookalike domains that could be used in phishing attacks.
Popular in Website & URL Scanners
Well-known listings from the same topic.
InfoSniperinfosniper.netWho.iswho.isRobtexrobtex.comQuantcastquantcast.comWeb Checkweb-check.as93.netFullHuntfullhunt.io
Dnstwist FAQ
How do I filter results to only show registered domain permutations?
Use the --registered flag when running the dnstwist command.
Can I use custom dictionary files to generate additional domain permutations?
Yes, supply a dictionary file via the --dictionary argument.
What output formats are available for dnstwist results?
Results can be exported to CSV, JSON, or plain list formats.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.