---
id: dnstwist
version: "20250130"
license: ASL 2.0
license_treatment: permissive
maintenance: aging
---

# dnstwist — Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

License: permissive · Maintenance: aging · Downloads: 119.7K/mo

## What it is and what it does

dnstwist is a domain fuzzing tool that generates permutations of a given domain name to uncover potentially malicious lookalike domains. It applies multiple fuzzing algorithms (homoglyph, hyphenation, transposition, and others) to create variants and then verifies which ones are registered via DNS lookups. The tool is designed to help organizations identify typosquatting, phishing, and brand impersonation threats targeting their domain.

Beyond basic domain enumeration, dnstwist offers advanced threat detection: it can compare HTML source code of discovered domains against the original using fuzzy hashing (ssdeep or TLSH) to detect phishing sites with similar content, capture and compare web page screenshots using perceptual hashing when Chromium is available, detect rogue MX hosts, and perform GeoIP lookups on resolved addresses. Results can be exported to CSV or JSON, and the tool exposes a Python API for programmatic use.

Use it for:

- Monitor for typosquatted domains targeting your organization and alert on newly registered lookalikes
- Conduct phishing campaign reconnaissance by generating domain variants and checking for active phishing pages
- Audit brand impersonation risk by discovering domains that visually or semantically resemble your legitimate domain
- Integrate domain threat intelligence into security workflows via the Python API to automate threat detection
- Perform passive domain enumeration to generate permutation lists without DNS queries for offline analysis

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Generates domain name permutations to detect typosquatting, phishing, and brand impersonation attacks, with optional live phishing detection via HTML and visual similarity analysis.

Yes, if you need to monitor for domain-based threats. The tool is well-maintained despite aging status, has no external dependencies, and offers both CLI and programmatic interfaces. Install the base package for core fuzzing; add optional dependencies only if you need phishing detection or GeoIP features. No known vulnerabilities.

## Install

pip install dnstwist
uv add dnstwist
poetry add dnstwist

## Installing dnstwist

Before you install: Low install friction with no runtime dependencies. Maintenance status is aging—last release was 561 days ago, though the repository remains active with recent commits and substantial community interest (5727 stars).

License in practice: Licensed under Apache Software License (ASL 2.0), a permissive license allowing commercial use, modification, and distribution with minimal restrictions.

Quickstart:

pip install dnstwist

import dnstwist
data = dnstwist.run(domain='example.com', registered=True, format='null')

Phishing detection features (--phash) require Chromium browser installed; GeoIP features require GeoLite2 database and environment variable setup.

Verify before relying:

- Whether optional features (phishing detection, GeoIP, screenshots) require additional system dependencies beyond Python
- Specific Python version requirements, as the fact sheet does not specify a minimum version
- Performance characteristics when processing very large domain lists or with concurrent requests

## Package facts

- License: ASL 2.0 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: aging
- Downloads: 119.7K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

domain typosquatting detection, phishing domain finder, homograph attack detection, DNS fuzzing tool, brand impersonation monitoring, lookalike domain generator, domain permutation engine, threat-intelligence, domain-security, phishing-detection

[View on SkillFed](https://skillfed.io/packages/dnstwist) · [View on PyPI](https://pypi.org/project/dnstwist/)