NAME

       dnstwist - domain name permutation engine

SYNOPSIS

       dnstwist [OPTION...] DOMAIN

DESCRIPTION

       Find  similar-looking domain names that adversaries can use to attack you. Detect typosquatters, phishing
       attacks, fraud and brand impersonation.

COMMAND-LINE OPTIONS

       -a, --all
              Print all DNS records instead of the first ones.

       -b, --banners
              Determine HTTP and SMTP service banners.

       -d, --dictionary FILE
              Generate additional domains using a dictionary read from FILE.

       -f, --format FORMAT
              Select the output format. Supported values are: cli (default), csv, list, json.

       --fuzzers LIST
              Use only selected fuzzing algorithms (separated with commas).

       -g, --geoip
              Perform lookup for GeoIP location.

       --lsh [LSH]
              Evaluate web page similarity with LSH algorithm: ssdeep (default), tlsh

       --lsh-url URL
              Override URL to fetch the original web page from.

       -h, --help
              Display help message and exit.

       -m, --mxcheck
              Check if MX host can be used to intercept e-mails.

       -o, --output FILE
              Save output to FILE.

       -r, --registered
              Show only registered domain names.

       -u, --unregistered
              Show only unregistered domain names.

       -p, --phash
              Render web pages and compare their perceptual hashes to evaluate visual similarity.

       --phash-url URL
              Override URL to render the original web page from.

       --screenshots DIR
              Save web page screenshots into DIR.

       -t, --threads NUM
              Start specified NUM of threads.

       -w, --whois
              Lookup WHOIS database for creation date and registrar.

       --nameservers LIST
              DNS or DNS-over-HTTPS servers to query (comma-separated LIST).

       --tld FILE
              Generate additional domains by swapping TLD as read from FILE.

       --useragent STRING
              Set User-Agent STRING (default: Mozilla/5.0 (platform arch) dnstwist/version).

NOTES

       DNS fuzzing is an automated workflow for discovering potentially malicious domain names.

       The tool will run the provided domain name  through  its  fuzzing  algorithms  and  generate  a  list  of
       potential  phishing  domains  along  with  DNS  records.   Usually  thousands  of domain permutations are
       generated - especially for longer input domains. In such cases, it  may  be  practical  to  display  only
       registered (resolvable) ones using --registered argument.

       Ensure  your  local DNS server can handle thousands of requests within a short period of time. Otherwise,
       you can specify an external DNS or DNS-over-HTTPS server with --nameservers argument.

   Fuzzy hashing
       Manually checking each domain name in terms of serving  a  phishing  site  might  be  time-consuming.  To
       address  this, dnstwist makes use of so-called fuzzy hashes (locality-sensitive hash, LSH) and perceptual
       hashes (pHash). Fuzzy hashing is a concept that involves the ability to compare two  inputs  (HTML  code)
       and  determine  a  fundamental  level  of similarity, while perceptual hash is a fingerprint derived from
       visual features of an image (web  browser  screenshot).  The  level  of  similarity  is  expressed  as  a
       percentage.

       Keep  in  mind it's rather unlikely to get 100% match for a dynamically generated web page. However, each
       notification is a strong indicator and should be inspected carefully regardless of the score.

   Dictionaries
       If domain permutations generated by the fuzzing algorithms  are  insufficient,  please  use  --dictionary
       option with a file to generate more domain variants.  If you need to check whether domains with different
       TLDs exist, you can use --tld argument.

   Coverage
       Along  with  the  length  of  the  domain,  the  number of variants generated by the algorithms increases
       considerably, and therefore the time and resources needed to verify them. It's mathematically  impossible
       to  check  all  domain permutations - especially for longer input domains which would require millions of
       DNS lookups. For this reason, this tool generates and checks domains very  close  to  the  original  one.
       Theoretically, these are the most attractive domains from the attacker's point of view. However, be aware
       that the imagination of the aggressors is unlimited.

       Unicode  tables  consist  of  thousands  of  characters with many of them visually similar to each other.
       However, despite the fact certain characters are encodable using  punycode,  most  TLD  authorities  will
       reject them during domain registration process. In general, TLD authorities disallow mixing of characters
       coming  from  different  Unicode  scripts  or maintain their own sets of acceptable characters. With that
       being said, the homoglyph fuzzer was build on top of carefully researched  range  of  Unicode  characters
       (homoglyphs) to ensure that generated domains can be registered in practice.

AUTHOR

       Marcin Ulikowski <marcin@ulikowski.pl>

                                                  December 2022                                      DNSTWIST(1)