NAME

       dnstwist - domain name permutation engine

SYNOPSIS

       dnstwist [-a|--all] [-b|--banners] [-d|--dictionary FILE] [-f|--format FORMAT] [-g|--geoip]
                [-m|--mxcheck] [-o|--output FILE] [-r|--registered] [-s|--ssdeep] [--ssdeep-url URL]
                [-t|--threads NUMBER] [-w|--whois] [--nameservers LIST] [--tld FILE] [--useragent STRING] DOMAIN

DESCRIPTION

       Find similar-looking domain names that adversaries can use to attack you.

       Detect typosquatters, phishing attacks, fraud and brand impersonation.

       Useful as an additional source of targeted threat intelligence.

OPTIONS

       -a, --all
              Show all DNS records.

       -b, --banners
              Determine HTTP and SMTP service banners.

       -d, --dictionary FILE
              Generate additional domains using a dictionary read from FILE.

       -f, --format FORMAT
              Select the output format. Supported values are: cli (default), csv, list, json.

       -g, --geoip
              Perform lookup for GeoIP location.

       -h, --help
              Display a help message and exit.

       -m, --mxcheck
              Check if MX host can be used to intercept e-mails.

       -o, --output FILE
              Save output to FILE.

       -r, --registered
              Show only registered domain names.

       -s, --ssdeep
              Fetch web pages and compare their fuzzy hashes to evaluate similarity.

       --ssdeep-url URL
              Override URL to fetch the original web page from.

       -t, --threads NUMBER
              Start specified NUMBER of threads (default: 10).

       -w, --whois
              Perform lookup for WHOIS creation date.

       --nameservers LIST
              DNS servers to query (comma-separated LIST).

       --tld FILE
              Generate additional domains by swapping TLD as read from FILE.

       --useragent STRING
              User-Agent to send with HTTP requests (default: Mozilla/5.0 dnstwist).

NOTES

       The  program will run the provided domain through its fuzzing algorithms and generate a list of potential
       phishing domains with the following DNS records: A,  AAAA,  NS  and  MX.   Usually  thousands  of  domain
       permutations  are generated - especially for longer input domains.  In such cases, it may be practical to
       display only registered (resolvable) ones using --registered argument.  Ensure your local DNS server  can
       handle  thousands  of requests within a short period of time.  Otherwise, you can specify an external DNS
       server with --nameservers argument.

   Fuzzy hashing
       Manually checking each domain name in terms of serving a  phishing  site  might  be  time-consuming.   To
       address  this,  dnstwist makes use of so-called fuzzy hashes (context triggered piecewise hashes).  Fuzzy
       hashing is a concept which involves the ability to compare two  inputs  (in  this  case  HTML  code)  and
       determine  a  fundamental  level  of  similarity.   This  unique  feature of dnstwist can be enabled with
       --ssdeep argument.  For each generated domain, dnstwist will fetch content from  responding  HTTP  server
       (following possible redirects) and compare its fuzzy hash with the one for the original (initial) domain.
       The level of similarity will be expressed as a percentage.

       Please  keep  in  mind  it's  rather  unlikely  to  get  100% match for a dynamically generated web page.
       However, each notification should be inspected carefully regardless of the score.

       In some cases, phishing sites are served from a specific URL.  If you  provide  a  full  or  partial  URL
       address as an argument, dnstwist will parse it and apply for each generated domain name variant.  This is
       obviously useful only with the fuzzy hashing feature.

   MX checking
       Very  often  attackers  set  up  e-mail  honey  pots on phishing domains and wait for mistyped e-mails to
       arrive.  In this scenario, attackers would configure their server to vacuum up all  e-mail  addressed  to
       that  domain,  regardless  of  the user it was sent towards. Another dnstwist feature allows performing a
       simple test on each mail server (advertised through DNS MX record) in order to check  which  one  can  be
       used for such hostile intent.  Suspicious servers will be marked with the SPYING-MX string.

       Please  be  aware  of  possible  false  positives.   Some mail servers only pretend to accept incorrectly
       addressed e-mails but then discard  those  messages.   This  technique  is  used  to  prevent  "directory
       harvesting attack".

   Dictionaries
       If  domain  permutations  generated  by  the fuzzing algorithms are insufficient, please use --dictionary
       option with a file to generate more domain variants.  If you need to check whether domains with different
       TLDs exist, you can use --tld argument.

   Coverage
       Along with the length of the domain, the  number  of  variants  generated  by  the  algorithms  increases
       considerably,  and  therefore  the  number  of  DNS  queries  needed  to verify them. It's mathematically
       impossible to check all domain permutations - especially for longer input domains.

       For this reason, dnstwist generates and checks domains very close to the  original  one.   Theoretically,
       these  are  the  most  attractive  domains from the attacker's point of view.  However, be aware that the
       imagination of the aggressors is unlimited.

                                                   2020-07-05                                        DNSTWIST(1)