DNSTWIST

DNSTWIST is a domain name permutation engine developed by elceef. According to the vendor, it is designed to detect various types of domain-related attacks, including homograph phishing, typo squatting, and brand impersonation. This software generates comprehensive lists of domain permutations based on a provided domain name and verifies their usage. The vendor claims that DNSTWIST is suitable for organizations of all sizes, from small businesses to large enterprises. It is said to be widely used by cybersecurity professionals, IT administrators, brand protection teams, law enforcement agencies, and domain registrars and registries to enhance domain name security, prevent attacks, and safeguard brand reputation.

Key Features

Variety of domain fuzzing algorithms: DNSTWIST offers a range of domain fuzzing algorithms, including homoglyph fuzzing, insertion fuzzing, omission fuzzing, substitution fuzzing, transposition fuzzing, and hyphenation fuzzing. These algorithms are claimed to generate comprehensive lists of domain permutations for thorough analysis.

Unicode domain names (IDN): According to the vendor, DNSTWIST supports Unicode domain names (IDN), enabling users to generate domain permutations that include characters from different Unicode scripts. This feature is said to help detect homograph attacks that utilize visually similar characters.

Additional domain permutations from dictionary files: Users can enhance the domain fuzzing process by providing DNSTWIST with dictionary files containing commonly used words or phrases. The vendor claims that this feature allows the generation of additional domain permutations for comprehensive analysis.

Efficient multithreaded task distribution: DNSTWIST utilizes efficient multithreading to distribute domain fuzzing tasks across multiple threads. This is said to enable faster processing of large numbers of domain permutations, ensuring timely results even for extensive analyses.

Live phishing webpage detection: According to the vendor, DNSTWIST can detect live phishing webpages by comparing the HTML similarity of generated domains with the original domain. It utilizes fuzzy hashes such as ssdeep and tlsh to identify similarity and detect ongoing phishing attacks.

Screenshot visual similarity comparison: DNSTWIST compares the visual similarity of webpage screenshots using perceptual hashes (pHash). The vendor claims that this feature helps identify visually similar webpages, enabling the detection of brand impersonation and fraud.

Rogue MX host detection: By analyzing MX records, DNSTWIST can detect rogue MX hosts that intercept misdirected emails. According to the vendor, this feature helps identify potential instances of email redirection and alerts users to potential security risks.

GeoIP location: DNSTWIST performs real-time lookups to determine the geographical location (approximated to the country) of IPv4 addresses associated with generated domains. The vendor states that this feature provides users with valuable information about the potential origin of the domains.

Export to CSV and JSON: DNSTWIST allows users to export the generated domain permutations and their associated information to CSV and JSON formats. This feature is claimed to facilitate easy integration with other tools, analysis, and further processing of the data.