Tool profile
dnstwist
Find lookalike domains for brand and phishing triage
Claims and corrections are reviewed before public profile changes.
Signal summary
Trust / disclosure
How to read this profile
Editorial line
Editorial judgment and commercial context are kept separate on OSINT4ALL.
Review status
This profile has an editorial review date. Source checking does not mean the tool was hands-on tested.
Claims / submissions
Corrections and claim requests are reviewed before any public change is made.
Commercial context
No commercial relationship is disclosed on this profile.
Editorial verdict
Use case and fit
This is editorial guidance, not vendor copy.
Checking suspicious typo, homoglyph and naming variants around an authorized brand or domain.
Browser demonstration and CLI are one tool identity; no offensive impersonation workflow included.
Best for checking suspicious typo, homoglyph and naming variants around an authorized brand or domain.
Operational snapshot
Workflow, access, and coverage
DNS and domain infrastructure intelligence, URL and page behavior observation
Domain, Hostname, IP Address, Organization, URL
DNS Record, Subdomain, Nameserver History, Infrastructure Link, Page Render
Discovery, Enrichment, Pivoting, Preservation, Verification
Choose the protected domain; generate variants; record resolution and registration context; inspect only in a safe environment; corroborate page behavior and dates; escalate verified cases.
English-first editorial profile. Verify current interface languages and source-language coverage; multilingual input does not guarantee equal analytical quality.
Limits
Strengths, caveats, and risk
Systematic permutations help avoid a purely ad hoc lookalike search.
Registered variants can be benign; optional page comparison and resolution generate network activity.
A similar domain name or page does not alone prove phishing, common control or malicious intent. A lookalike-domain match is a lead, not proof of phishing, common control, or malicious intent; corroborate it with registration, hosting, page-behavior, and date evidence.
A similar domain name or page does not alone prove phishing, common control or malicious intent. A lookalike-domain match is a lead, not proof of phishing, common control, or malicious intent; corroborate it with registration, hosting, page-behavior, and date evidence.
Keep work within authorized scope; no credential use, exploitation or intrusive probing without explicit permission.
Dated infrastructure observations do not establish ownership, compromise or attribution. Official-source desk research only; not hands-on tested. Tool-specific caution: A similar domain name or page does not alone prove phishing, common control or malicious intent. A lookalike-domain match is a lead, not proof of phishing, common control, or malicious intent; corroborate it with registration, hosting, page-behavior, and date evidence.
Maintenance
Source status & suggest an update
Help keep this profile accurate. Update requests are reviewed and logged before publication.
Source checked: 2026-09-19
If something is outdated, please submit a correction or ownership update request. Claim requests are reviewed and do not grant editorial control.
Commercial or sponsorship requests use the separate partner workflow.