dnstwist
Installation
Section titled “Installation”From PyPI
Section titled “From PyPI”pip install dnstwistFrom Source
Section titled “From Source”git clone https://github.com/elceef/dnstwist.git
cd dnstwist
pip install -e .Docker
Section titled “Docker”docker run -it elceef/dnstwist dnstwist example.comRequirements
Section titled “Requirements”- Python 3.7+
dnspython— DNS resolutionrequests— HTTP requestsurllib3— URL parsingGeoIP2database (optional, for geolocation)
Basic Usage
Section titled “Basic Usage”Simple Permutation Check
Section titled “Simple Permutation Check”dnstwist example.comCheck and Resolve DNS
Section titled “Check and Resolve DNS”dnstwist -r example.comExtended Output with Registered Domains
Section titled “Extended Output with Registered Domains”dnstwist -r --registered example.comVerbose Mode
Section titled “Verbose Mode”dnstwist -v example.comPermutation Types
Section titled “Permutation Types”Bitsquatting
Section titled “Bitsquatting”Domain names differing by single bit flip in DNS wire format.
dnstwist --bitsquatting example.comHomoglyph Attack
Section titled “Homoglyph Attack”Visually similar characters (e.g., rn → m, 0 → O).
dnstwist --homoglyph example.comInsertion
Section titled “Insertion”Add characters within domain name.
dnstwist --insertion example.comOmission
Section titled “Omission”Remove single characters from domain.
dnstwist --omission example.comRepetition
Section titled “Repetition”Double consecutive characters.
dnstwist --repetition example.comReplacement
Section titled “Replacement”Replace characters with similar ones.
dnstwist --replacement example.comTransposition
Section titled “Transposition”Swap adjacent characters.
dnstwist --transposition example.comVowel Swap
Section titled “Vowel Swap”Replace vowels with other vowels.
dnstwist --vowelswap example.comAddition
Section titled “Addition”Add common TLD variations and prefixes/suffixes.
dnstwist --addition example.comHyphenation
Section titled “Hyphenation”Add hyphens at various positions.
dnstwist --hyphenation example.comAll Permutation Types
Section titled “All Permutation Types”dnstwist -a example.comDNS Resolution
Section titled “DNS Resolution”Resolve A Records
Section titled “Resolve A Records”dnstwist -r example.comResolve AAAA Records (IPv6)
Section titled “Resolve AAAA Records (IPv6)”dnstwist -r --aaaa example.comResolve with Specific Nameserver
Section titled “Resolve with Specific Nameserver”dnstwist -r -ns 8.8.8.8 example.comCheck Registration Status
Section titled “Check Registration Status”dnstwist --registered example.comVerify DNSSEC
Section titled “Verify DNSSEC”dnstwist -r --dnssec example.comMX Record Checking
Section titled “MX Record Checking”Detect MX Records
Section titled “Detect MX Records”dnstwist -r example.com | grep MXFull MX Verification
Section titled “Full MX Verification”dnstwist -r --mx example.comMail Server Analysis
Section titled “Mail Server Analysis”dnstwist -r -mx example.com | head -20GeoIP Lookup
Section titled “GeoIP Lookup”Enable GeoIP Resolution
Section titled “Enable GeoIP Resolution”dnstwist -r --geoip example.comDownload GeoIP2 Database
Section titled “Download GeoIP2 Database”# Requires MaxMind account
curl https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-City&license_key=YOUR_KEY&suffix=tar.gz -o geolite2.tar.gz
tar xzf geolite2.tar.gzUse Custom GeoIP Database
Section titled “Use Custom GeoIP Database”dnstwist -r --geoip --db /path/to/GeoLite2-City.mmdb example.comWeb Page Similarity Detection
Section titled “Web Page Similarity Detection”Fuzzy Hash Comparison
Section titled “Fuzzy Hash Comparison”dnstwist -r --ssdeep example.comDetect Phishing Pages
Section titled “Detect Phishing Pages”dnstwist -r --ssdeep --verify example.comHTTP Banner Grabbing
Section titled “HTTP Banner Grabbing”dnstwist -r --http example.comHTTPS Certificate Analysis
Section titled “HTTPS Certificate Analysis”dnstwist -r --cert example.comOutput Formats
Section titled “Output Formats”CSV Output
Section titled “CSV Output”dnstwist -r --csv example.com > results.csvJSON Output
Section titled “JSON Output”dnstwist -r --json example.com > results.jsonList Format (Default)
Section titled “List Format (Default)”dnstwist -r example.com > results.txtDomain Names Only
Section titled “Domain Names Only”dnstwist example.com | cut -d' ' -f1Registered Domains Only
Section titled “Registered Domains Only”dnstwist -r example.com | grep -E "^[a-z].*\[" | cut -d' ' -f1Dictionary-Based Generation
Section titled “Dictionary-Based Generation”Add Dictionary Words
Section titled “Add Dictionary Words”dnstwist -w /path/to/wordlist.txt example.comGenerate with Common Dictionary
Section titled “Generate with Common Dictionary”dnstwist -w /usr/share/dict/words example.comDictionary-Only Mode
Section titled “Dictionary-Only Mode”dnstwist -w wordlist.txt --dictionary-only example.comWordlist Format
Section titled “Wordlist Format”# One word per line
malware
phishing
security
adminCombine with Permutations
Section titled “Combine with Permutations”dnstwist -w wordlist.txt -a example.comWHOIS Lookups
Section titled “WHOIS Lookups”Basic WHOIS Query
Section titled “Basic WHOIS Query”dnstwist -r example.com | grep WHOISRegistrar Information
Section titled “Registrar Information”whois examplee.comBulk WHOIS Batch
Section titled “Bulk WHOIS Batch”dnstwist -r --whois example.comMonitoring and Automation
Section titled “Monitoring and Automation”Run Periodic Checks (Bash Loop)
Section titled “Run Periodic Checks (Bash Loop)”while true; do
dnstwist -r --json example.com > check_$(date +%s).json
sleep 3600 # Check hourly
doneContinuous Monitoring with cron
Section titled “Continuous Monitoring with cron”# Add to crontab -e
0 * * * * /usr/local/bin/dnstwist -r --json example.com >> /var/log/dnstwist.logReal-Time Monitoring Script
Section titled “Real-Time Monitoring Script”#!/bin/bash
domain="example.com"
baseline=$(dnstwist -r --json "$domain")
while true; do
current=$(dnstwist -r --json "$domain")
if [ "$baseline" != "$current" ]; then
echo "Change detected at $(date)" | mail -s "dnstwist Alert" admin@example.com
baseline="$current"
fi
sleep 300
doneLog Results to Database
Section titled “Log Results to Database”dnstwist -r --json example.com | jq . | sqlite3 dnstwist.dbAPI and CI Integration
Section titled “API and CI Integration”JSON API Output for Integration
Section titled “JSON API Output for Integration”dnstwist -r --json example.com | jq '.[] | select(.dns_a != null)'Parse JSON Results
Section titled “Parse JSON Results”dnstwist -r --json example.com | jq '.[] | {domain, dns_a, dns_aaaa, whois_created}'Filter Registered Domains
Section titled “Filter Registered Domains”dnstwist -r --json example.com | jq '.[] | select(.dns_a != null) | .domain'GitHub Actions Integration
Section titled “GitHub Actions Integration”name: dnstwist Security Check
on: [schedule]
jobs:
dnstwist:
runs-on: ubuntu-latest
steps:
- uses: actions/setup-python@v2
- run: pip install dnstwist
- run: dnstwist -r --json example.com > results.json
- uses: actions/upload-artifact@v2
with:
name: dnstwist-results
path: results.jsonGitLab CI Integration
Section titled “GitLab CI Integration”dnstwist_scan:
image: python:3.9
script:
- pip install dnstwist
- dnstwist -r --json example.com > results.json
artifacts:
paths:
- results.jsonJenkins Pipeline
Section titled “Jenkins Pipeline”pipeline {
stages {
stage('dnstwist Scan') {
steps {
sh 'pip install dnstwist'
sh 'dnstwist -r --json example.com > results.json'
archiveArtifacts artifacts: 'results.json'
}
}
}
}Advanced Options
Section titled “Advanced Options”Custom Threads for Parallel Resolution
Section titled “Custom Threads for Parallel Resolution”dnstwist -r --threads 10 example.comSet DNS Query Timeout
Section titled “Set DNS Query Timeout”dnstwist -r --timeout 2 example.comName Server Configuration
Section titled “Name Server Configuration”dnstwist -r -ns 1.1.1.1 example.comDisable DNSSEC Validation
Section titled “Disable DNSSEC Validation”dnstwist -r --no-dnssec example.comQuiet Mode (Minimal Output)
Section titled “Quiet Mode (Minimal Output)”dnstwist -q example.comTypical Workflows
Section titled “Typical Workflows”Complete Phishing Investigation
Section titled “Complete Phishing Investigation”dnstwist -r -a --ssdeep --geoip --json example.com > investigation.jsonMonitor High-Risk Domains
Section titled “Monitor High-Risk Domains”for domain in company.com company.org company.net; do
echo "=== $domain ==="
dnstwist -r --registered "$domain"
doneGenerate Squatting Report
Section titled “Generate Squatting Report”dnstwist -r --csv -a example.com > squatting_report.csv
# Then import into spreadsheet for analysisCheck Permutations Without Resolution
Section titled “Check Permutations Without Resolution”dnstwist example.com | wc -l # Total permutations
dnstwist example.com # List all potential domainsFind Only Suspicious Registrations
Section titled “Find Only Suspicious Registrations”dnstwist -r example.com | grep -E "\[A\]|\[MX\]" | grep -v "$(dig +short example.com)"Performance Tips
Section titled “Performance Tips”- Reduce Threads for API Rate Limits:
--threads 2on restricted networks - Skip DNS Verification: Remove
-rflag for faster enumeration - Filter by Permutation Type: Use specific flags instead of
-ato reduce output - Export to CSV Early: Process data in spreadsheet tools rather than terminal
- Batch Multiple Domains: Create script to iterate and append to single JSON
Common Issues
Section titled “Common Issues”DNS Timeout
Section titled “DNS Timeout”# Increase timeout value
dnstwist -r --timeout 5 example.comRate Limiting
Section titled “Rate Limiting”# Add delay between requests
dnstwist -r --threads 1 example.comGeoIP Database Not Found
Section titled “GeoIP Database Not Found”# Ensure database is in expected location
dnstwist -r --geoip --db ~/GeoLite2-City.mmdb example.comMemory Usage with Large Wordlists
Section titled “Memory Usage with Large Wordlists”# Process in chunks instead
split -l 1000 wordlist.txt chunk_
for chunk in chunk_*; do
dnstwist -w "$chunk" example.com
doneSecurity Best Practices
Section titled “Security Best Practices”- Responsible Disclosure: Only test domains you own or have authorization for
- Rate Limiting: Respect DNS provider rate limits and ISP policies
- Logging: Enable verbose mode during investigations for audit trails
- Automation Consent: Inform stakeholders of automated monitoring
- Data Privacy: Securely store results containing sensitive information
- Legal Compliance: Verify domain monitoring is within acceptable use policies