DNSTWIST(1)

💖 NAME 💖

okay bestie, so dnstwist is literally a domain name permutation engine — that's the whole vibe. (also hi, this is the DNSTWIST(1) page from the User Commands manual, in case you were wondering who let me in here 🎀)

---

✨ SYNOPSIS ✨

dnstwist [OPTION...] DOMAIN

---

🦋 DESCRIPTION 🦋

so the whole point?? finding similar-looking domain names that bad actors could use to come for you. it's giving typosquatters, phishing attacks, fraud, brand impersonation — the full toxic ex energy of the internet 💀

---

👑 COMMAND-LINE OPTIONS 👑

one bullet per flag, no skips, no skips, periodt:

• -a, --all — print all the DNS records instead of just the first ones. greedy? yes. correct? also yes.
• -b, --banners — go figure out the HTTP and SMTP service banners. sniff sniff 👀
• -d, --dictionary FILE — generate extra domains using a dictionary you read from FILE.
• -f, --format FORMAT — pick your output format. supported values are: cli (the default, bestie), csv, list, json.
• --fuzzers LIST — only use the selected fuzzing algorithms (separate them with commas, like a lil list).
• -g, --geoip — do a lookup for GeoIP location. where in the world 🌍
• --lsh [LSH] — evaluate web page similarity with the LSH algorithm: ssdeep (the default) or tlsh.
• --lsh-url URL — override the URL used to fetch the original web page from.
• -h, --help — display the help message and dip out. bye 👋
• -m, --mxcheck — check whether the MX host can be used to intercept e-mails.
• -o, --output FILE — save the output to FILE.
• -r, --registered — show only registered domain names.
• -u, --unregistered — show only unregistered domain names.
• -p, --phash — render the web pages and compare their perceptual hashes to figure out visual similarity 👁️✨
• --phash-url URL — override the URL used to render the original web page from.
• --screenshots DIR — save web page screenshots into DIR. 📸
• -t, --threads NUM — start NUM threads. go fast, bestie.
• -w, --whois — look up the WHOIS database for creation date and registrar 🕵️‍♀️
• --nameservers LIST — the DNS or DNS-over-HTTPS servers to query (comma-separated LIST).
• --tld FILE — generate extra domains by swapping the TLD as read from FILE.
• --useragent STRING — set the User-Agent STRING (default: Mozilla/5.0 (platform arch) dnstwist/version).

---

🌸 NOTES 🌸

DNS fuzzing is an automated workflow for discovering potentially malicious domain names. iykyk.

the tool runs your provided domain name through its fuzzing algorithms and generates a list of potential phishing domains along with DNS records. usually thousands of domain permutations get generated — especially for longer input domains. when that happens, it may be practical to display only the registered (resolvable) ones using the --registered argument. fr fr.

heads up bestie: make sure your local DNS server can handle thousands of requests within a short period of time. otherwise, you can specify an external DNS or DNS-over-HTTPS server with the --nameservers argument. don't crash your resolver, it's not cute 😭

🧚 Fuzzy hashing 🧚

manually checking every single domain name to see if it's serving a phishing site might be time-consuming. to address this, dnstwist makes use of so-called fuzzy hashes (locality-sensitive hash, LSH) and perceptual hashes (pHash). fuzzy hashing is a concept that involves the ability to compare two inputs (HTML code) and determine a fundamental level of similarity, while perceptual hash is a fingerprint derived from visual features of an image (web browser screenshot). the level of similarity is expressed as a percentage. math queen behavior 💅

keep in mind it's rather unlikely to get a 100% match for a dynamically generated web page. however, each notification is a strong indicator and should be inspected carefully regardless of the score. no skipping the vibes check just because the number is low.

🍓 Dictionaries 🍓

if the domain permutations generated by the fuzzing algorithms are insufficient, please use the --dictionary option with a file to generate more domain variants. and if you need to check whether domains with different TLDs exist, you can use the --tld argument. more options = more chaos = more coverage 🎀

🌈 Coverage 🌈

along with the length of the domain, the number of variants generated by the algorithms increases considerably — and therefore so do the time and resources needed to verify them. it's mathematically impossible to check all domain permutations, especially for longer input domains which would require millions of DNS lookups. for this reason, this tool generates and checks domains very close to the original one. theoretically, these are the most attractive domains from the attacker's point of view. however, be aware that the imagination of the aggressors is unlimited. they will think of things you did not. scary but true 💀

Unicode tables consist of thousands of characters, with many of them visually similar to each other. however, despite the fact certain characters are encodable using punycode, most TLD authorities will reject them during the domain registration process. in general, TLD authorities disallow mixing of characters coming from different Unicode scripts, or maintain their own sets of acceptable characters. with that being said, the homoglyph fuzzer was built on top of a carefully researched range of Unicode characters (homoglyphs) to ensure that generated domains can actually be registered in practice. science, but make it shady ✨

---

💜 AUTHOR 💜

Marcin Ulikowski <marcin@ulikowski.pl>

---

okay that's the whole page bestie, go forth and typosquat-hunt 🫶 this was the User Commands manual, December 2022 edition — and yes the date is giving vintage but she still eats. mwah 💅⭐