What is dnstwist?

This Python tool takes a domain name and generates hundreds of similar-looking variants that could be used in phishing attacks or brand impersonation. If you give it a domain like "example.com", it produces alternatives such as character swaps, skipped or doubled letters, transpositions, and domains that use characters from other alphabets that look identical to Latin letters but are technically different. This last technique is called a homograph attack, and it is a common method attackers use to create convincing fake websites. The tool is designed for security teams and researchers who want to know what lookalike domains exist before attackers exploit them. By discovering which variants are registered or active, an organization can register the most dangerous lookalikes themselves, set up monitoring alerts, or work to take malicious domains down. Beyond generating the list of permutations, dnstwist can optionally check each one against live DNS records. This means it can tell you whether a lookalike domain is registered, what IP address it points to, whether it has an MX record suggesting it can receive email, and other indicators of active use. This makes it useful for actual threat intelligence gathering, not just listing possibilities. The topics associated with the project include DNS, domain fuzzing, homoglyphs, internationalized domain names, OSINT (open-source intelligence), and phishing. OSINT tools are those that gather information from publicly available sources rather than intrusion or exploitation, so dnstwist fits squarely into the defensive security toolkit. The repository points to a separate documentation folder for its full README, so the main project documentation is not included in the root file shown here.