PAGES
← all tools
◆ Threat Intelligence

dnstwist

20240116 open-source
source ↗ rss ↗ What is a cyber toolchain?

Summary

dnstwist is an open-source command-line tool that generates and checks domain-name permutations to find typosquattingtyposquattingUsing a name close to a trusted domain or software package to catch spelling mistakes. Attackers use it to lure people or installers to a malicious lookalike., phishing, and lookalike domains registered against a brand it is pointed at. It takes a domain like example.com and produces variants covering character substitution, omission, insertion, digit-appended forms, and internationalized/punycode lookalikes, then can fetch and compare the resulting pages against the original using similarity hashing (ssdeep or tlsh via --lsh) to flag likely impersonation. It is run as a CLI, with results either printed or redirected to a file for further processing, which suits threat-intel and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams doing domain-monitoring or phishing-detection work rather than continuous managed monitoring.

How dnstwist helps

Which lookalike domains exist for a brand nobody has registered defenses against?

generates the full range of character-substitution, omission, insertion, digit-appended, and punycode variants of a given domain, giving a list of what to check or watch

Is a suspicious domain actually impersonating a site or just a coincidental match?

fetches the page at each candidate domain and compares it against the original using similarity hashing, flagging the ones whose content closely resembles the source

Which of the many permutations of a domain are worth escalating to takedown or legal review?

separates registered, live lookalikes with high content similarity from the much larger set of unregistered or unrelated permutations, so triage starts from a short list

Can a brand's domain be convincingly spoofed using non-Latin characters?

includes internationalized domain name and punycode lookalikes in the generated permutations, surfacing script-mixing tricks that plain character-substitution checks miss

How do I get a list of lookalike domains into another tool for ongoing tracking?

writes results to a file instead of the screen, so the run's output can feed a separate monitoring or alerting pipeline

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 4 backed by code, an API document or a real run

Built from dnstwist's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What dnstwist offers you

  • Command-line interface3
All capabilities 5 capabilities
Typosquatting domain permutation generation verified Generates typosquatting permutations of a target domain, including digit-appended, character-substitution, omission, insertion, and IDN/punycode variants. 3 releases · 3 other sources · first seen Oct 2022

release

  • Adds new plural fuzzer option to --fuzzers argument. 20240116 · Jan 2024 · source · release history
  • Adds cyrillic fuzzer option to detect domain names using Cyrillic homographs that look like Latin characters 20221213 · Dec 2022 · source · release history
  • Added Format() class 20221011 · Oct 2022 · source · release history

we ran it

  • The output (truncated) lists a large number of typosquatting permutations of example.com, including digit-appended variants (example0.com–example9.com), character-substitution variants (eyample.com,… Aug 2026 · the full run

example

  • Scan for domain variants using the new plural fuzzer through a corporate HTTP proxy. dnstwist example.com --fuzzers plural --proxy http://proxy.example.com:8080 20240116 · Jan 2024 · source
  • Use the new Format() class to standardize domain output strings. import dnstwist output = dnstwist.Format(result) 20221011 · Oct 2022 · source
Domain similarity detection with fuzzy hashing verified suggested Evaluates similarity between web pages using locality-sensitive hashing algorithms (ssdeep or tlsh), with optional URL override for fetching the original page. 1 release · 4 other sources · first seen Apr 2023

previously: Web page similarity detection with LSH

Suggested capability: Threat indicator matching. This is our guess, not confirmed.

release

  • --lsh flag replaces --ssdeep to allow requesting particular fuzzy hash (ssdeep or tlsh) 20230402 · Apr 2023 · source · release history

command line

  • --lsh-url — Override URL to fetch the original web page from 20230402 · Apr 2023 · command-line history
  • --lsh — Evaluate web page similarity with LSH algorithm: ssdeep, tlsh (default: ssdeep) 20230402 · Apr 2023 · command-line history

example

  • Use tlsh for domain similarity detection dnstwist --lsh tlsh example.com 20230402 · Apr 2023 · source
  • Scan for domains using a specific fuzzy hash algorithm dnstwist --lsh ssdeep example.com 20230402 · Apr 2023 · source
Version reporting verified Displays the current version of the cyber tool via a CLI flag. 2 releases · 1 other source · first seen Oct 2022

Also counts toward: Command-line interface

release

  • Adds optional support for the TLSH algorithm, which is used as a fallback when ssdeep is unavailable 20221213 · Dec 2022 · source · release history
  • Added handler for HTML meta tag based redirections (while fetching URL content) 20221011 · Oct 2022 · source · release history

command line

Output to file verified Redirects results to a file on disk instead of stdout. 1 other source · first seen Aug 2026

Also counts toward: Command-line interface

we ran it

  • The command printed nothing to stdout, which is expected when --output redirects all results to a file. Aug 2026 · the full run
HTTP proxy support shipped Routes tool traffic through an HTTP proxy, supporting full proxy configuration and headless browser use cases. 1 release · first seen Jan 2024

Also counts toward: Command-line interface

release

  • Adds --proxy flag for full HTTP proxy support, including headless browser (perceptual hashing) capabilities. 20240116 · Jan 2024 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for dnstwist, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail dnstwist puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

5 entries

  1. January 20241
  3. September 20231
  5. April 20231
  7. December 20221
  9. October 20221

    5 entries

    1. 20240116 Jan 16, 2024 · release notes

      Adds HTTP proxy support with headless browser fingerprinting and a plural fuzzer engine to dnstwist

      └──▷ GET THIS VERSION 
      $ git clone --branch 20240116 https://github.com/elceef/dnstwist.git
# already have the repo? check out this version:
$ git checkout 20240116
      └──▷ TRY IT
      Scan for domain variants using the new plural fuzzer through a corporate HTTP proxy.
      $ dnstwist example.com --fuzzers plural --proxy http://proxy.example.com:8080
      • Adds --proxy flag for full HTTP proxy support, including headless browser (perceptual hashing) capabilities.
      • Adds new plural fuzzer option to --fuzzers argument.

      2 details in Everything

    2. 20230918 Sep 18, 2023 · release notes

      dnstwist v20230918 adds os.devnull output support and performance improvements

      └──▷ GET THIS VERSION 
      $ git clone --branch 20230918 https://github.com/elceef/dnstwist.git
# already have the repo? check out this version:
$ git checkout 20230918
      • Replaces external WHOIS module with a faster pure-Python implementation for improved domain name resolution speed

      1 detail in Everything

    3. 20230402 Apr 2, 2023 · release notes

      Adds --lsh flag to request specific fuzzy hash type (ssdeep or tlsh) for domain similarity checks

      └──▷ GET THIS VERSION 
      $ git clone --branch 20230402 https://github.com/elceef/dnstwist.git
# already have the repo? check out this version:
$ git checkout 20230402
      └──▷ TRY IT
      Scan for domains using a specific fuzzy hash algorithm
      $ dnstwist --lsh ssdeep example.com
      Use tlsh for domain similarity detection
      $ dnstwist --lsh tlsh example.com
      • --lsh flag replaces --ssdeep to allow requesting particular fuzzy hash (ssdeep or tlsh)
      • Updated web application with session sharing, janitor thread, memory limit, and input validation improvements

      2 details in Everything

    4. 20221213 Dec 13, 2022 · release notes

      Adds cyrillic fuzzer for homograph attacks and optional TLSH support as a fallback to ssdeep

      └──▷ GET THIS VERSION 
      $ git clone --branch 20221213 https://github.com/elceef/dnstwist.git
# already have the repo? check out this version:
$ git checkout 20221213
      • Adds cyrillic fuzzer option to detect domain names using Cyrillic homographs that look like Latin characters
      • Adds optional support for the TLSH algorithm, which is used as a fallback when ssdeep is unavailable

      2 details in Everything

    5. 20221011 Oct 11, 2022 · release notes

      New HTML meta tag redirect detection and Format() class for domain generation algorithms

      └──▷ GET THIS VERSION 
      $ git clone --branch 20221011 https://github.com/elceef/dnstwist.git
# already have the repo? check out this version:
$ git checkout 20221011
      └──▷ USE IT
      Use the new Format() class to standardize domain output strings.
      code 
      import dnstwist
output = dnstwist.Format(result)
      • Added handler for HTML meta tag based redirections (while fetching URL content)
      • Added Format() class

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in elceef/dnstwist, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 −2 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 578 days issues closed, last 12 months
    6. Open backlog 10 of 128 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 10
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 5,738
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback