osintverse-community/dnstwist
Finds registered look-alike domains for phishing, typosquatting and brand impersonation
Takes domain → finds domain, ip
No key · Python wheel
No key · Python wheel
Verified publisher
Find look-alike domains
3 tools. 3 run with ot in a sandbox on Windows, macOS and Linux; 1 with otlite on Linux and macOS, no Docker. Compare them side by side ↓
Phishing and brand impersonation start with a domain that looks like the real one: a swapped letter, a homoglyph, an extra hyphen or another TLD. These tools generate those variants and find the ones that are registered, or search each day's newly registered domains for a brand keyword, so impersonation shows up before it is used against anyone.
With ot, in a sandbox
All domain tools →Windows, macOS and Linux, with Docker or Podman. Each tool runs in a read-only container that can reach only the sites it declares, and every result comes back in the same JSON shape.
osintverse-community/ail-typo-squatting
Generates typo-squatting variants of a domain name with 20+ permutation algorithms such as homoglyphs and wrong TLDs
Takes domain → finds domain
No key · Python wheel
No key · Python wheel
Verified publisher
osintverse-community/opensquat
Finds newly registered look-alike domains for a brand keyword in the daily free domain feed
→ finds domain
No key · Docker
No key · Docker
Verified publisher
ot install osintverse-community/dnstwist osintverse-community/ail-typo-squatting osintverse-community/opensquatInstalls the first 3 in one go; ot auto d:… then runs every installed tool that takes a domain and saves the results. No ot yet? Install it in one line.
Without Docker, with otlite
All otlite tools →Linux and macOS. otlite installs each one with pip or git into its own virtualenv, pinned to a version it has tested: otlite install dnstwist.
The 3 registry tools side by side
| osintverse-community/ | domain | None | Online, passive | No | Python | No reports yet | fewer than 10 |
| osintverse-community/ | domain, ip | None | Online, passive | No | Python | No reports yet | fewer than 10 |
| osintverse-community/ | domain | None | Online, passive | No | Docker | No reports yet | fewer than 10 |
Facts from each tool's manifest and what people report about whether it works. "Reaches" says whether a run stays offline, reads public sources, sends requests about the target, or may notify them.
How to find look-alike domains
- Generate the variants of the domain and keep the ones that are registered (dnstwist).
- For each registered look-alike, check its DNS, mail records and WHOIS to see whether it is parked, for sale or set up to send mail.
- Watch new registrations for the brand name (opensquat) so later look-alikes show up the day they appear.
Every registry tool here runs on your machine in a sandbox, and ot auto d:… runs all the installed ones on one value.
Before you run one
Is a registered look-alike domain proof of phishing?
No. Many are parked, held defensively by the brand itself or bought by domain investors. Signs of intent are mail records (MX and SPF), a live site that copies the brand, or a recently issued certificate; the DNS and WHOIS tools show those.
What is the difference between dnstwist and ail-typo-squatting?
dnstwist generates variants and reports the ones that are registered. ail-typo-squatting generates a larger list with more than 20 algorithms, useful as the input to your own monitoring. opensquat starts from a keyword instead of a domain and reads the daily feed of new registrations.
Do these tools send my search anywhere?
No. ot runs each tool on your own machine in a read-only container that can only reach the sites the tool declares, and results stay in your results folder. The registry only counts installs.
Do I need an API key?
Most tools here work without one; the row says "Key required" when one is needed, and ot keys set stores it in your OS keychain so only that tool's container sees it.
More from a domain
SubdomainsEvery known URLWHOIS recordDNS recordsEmail addressesAll domain tools