dnstwist

What it is and what it does

dnstwist is a domain fuzzing tool that generates permutations of a given domain name to uncover potentially malicious lookalike domains. It applies multiple fuzzing algorithms (homoglyph, hyphenation, transposition, and others) to create variants and then verifies which ones are registered via DNS lookups. The tool is designed to help organizations identify typosquatting, phishing, and brand impersonation threats targeting their domain.

Beyond basic domain enumeration, dnstwist offers advanced threat detection: it can compare HTML source code of discovered domains against the original using fuzzy hashing (ssdeep or TLSH) to detect phishing sites with similar content, capture and compare web page screenshots using perceptual hashing when Chromium is available, detect rogue MX hosts, and perform GeoIP lookups on resolved addresses. Results can be exported to CSV or JSON, and the tool exposes a Python API for programmatic use.

Use it for:

• Monitor for typosquatted domains targeting your organization and alert on newly registered lookalikes
• Conduct phishing campaign reconnaissance by generating domain variants and checking for active phishing pages
• Audit brand impersonation risk by discovering domains that visually or semantically resemble your legitimate domain
• Integrate domain threat intelligence into security workflows via the Python API to automate threat detection
• Perform passive domain enumeration to generate permutation lists without DNS queries for offline analysis

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Generates domain name permutations to detect typosquatting, phishing, and brand impersonation attacks, with optional live phishing detection via HTML and visual similarity analysis.

Yes, if you need to monitor for domain-based threats. The tool is well-maintained despite aging status, has no external dependencies, and offers both CLI and programmatic interfaces. Install the base package for core fuzzing; add optional dependencies only if you need phishing detection or GeoIP features. No known vulnerabilities.

Install

dnstwist on PyPI

pip install dnstwist

uv add dnstwist

poetry add dnstwist

Installing dnstwist

Before you install

Low install friction with no runtime dependencies. Maintenance status is aging—last release was 561 days ago, though the repository remains active with recent commits and substantial community interest (5727 stars).

License in practice

Licensed under Apache Software License (ASL 2.0), a permissive license allowing commercial use, modification, and distribution with minimal restrictions.

Quickstart

pip install dnstwist

import dnstwist
data = dnstwist.run(domain='example.com', registered=True, format='null')

Phishing detection features (--phash) require Chromium browser installed; GeoIP features require GeoLite2 database and environment variable setup.

Verify before relying

• Whether optional features (phishing detection, GeoIP, screenshots) require additional system dependencies beyond Python
• Specific Python version requirements, as the fact sheet does not specify a minimum version
• Performance characteristics when processing very large domain lists or with concurrent requests

Package facts

Evidence: dnstwist-20250130-py3-none-any.whl

Tags

More Security packages

Further reading