macOS
Homebrewverified · 100%
brew install dnstwistlocal Homebrew formula metadata
brew
Install dnstwist with Homebrew, apk, apt, dnf, Nix
Test domains for typo squatting, phishing and corporate espionage. Version 20250130 via Homebrew; verified 2026-06-15.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add dnstwistAlpine Linux edge package indexes · dnstwist · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install dnstwistDebian stable package indexes · dnstwist · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install dnstwistFedora Rawhide package metadata · dnstwist · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#dnstwistnixpkgs package indexes · pkgs/by-name/dn/dnstwist/package.nix · source: api.github.com
overview
Package summary
Test domains for typo squatting, phishing and corporate espionage
Project links
Commands and aliases
- dnstwist
history
Project history and usage
dnstwist is a domain permutation and phishing-domain scanner used for typosquatting, homograph, brand impersonation, and targeted threat-intelligence workflows. It turns the old manual question of 'what lookalike domains exist?' into a repeatable CLI, API, and web workflow.
Project history
The GitHub repository was created in June 2015, and the first GitHub release, v1.00, was published in October 2015. The official README presents the tool as a way to find lookalike domains that adversaries can use for typosquatting, phishing, fraud, and brand impersonation.
Over time dnstwist grew beyond simple domain permutation. The README documents Unicode and homoglyph handling, dictionary and TLD permutation files, multithreaded lookups, fuzzy HTML similarity with ssdeep or TLSH, screenshot similarity with pHash, rogue MX detection, GeoIP, CSV/JSON export, a Python API, Docker images, and the dnstwist.it web scanner.
Adoption history
dnstwist has unusually strong adoption for a command-line security tool. The README documents installation through pip, Git, Debian/Ubuntu/Kali, Fedora, AUR, Homebrew, and Docker, and says the scanner is used by SOC and incident-response teams, independent analysts, and many named security products and services.
How it is used
Users run dnstwist against a domain, often with --registered to reduce the output to live domains, then inspect DNS, MX, GeoIP, web similarity, screenshot similarity, or exported CSV/JSON results. The tool can also be imported from Python through dnstwist.run for automated monitoring or enrichment pipelines.
Why package nerds care
dnstwist is package-nerd significant because it packages a security research workflow into a normal installable CLI while still offering optional heavyweight capabilities such as GeoIP databases, headless Chromium screenshots, fuzzy hashing libraries, Docker images, and a web scanner.
Timeline
- 2015: GitHub repository created.
- 2015: First GitHub release, v1.00, published.
- 2025: Release 20250130 published.
- 2025: GitHub metadata shows continued repository activity.
- 2026: Homebrew still carries dnstwist as a packaged security CLI.
Related projects
- The README names ssdeep, TLSH, pHash, GeoIP2, and Chromium as optional analysis components. It also lists integrations or downstream use in Splunk, SpiderFoot, Maltego, Intel Owl, CISA Crossfeed, Rapid7 InsightConnect SOAR, Palo Alto Cortex XSOAR, Fortinet FortiSOAR, and other security platforms.
Sources
security posture
No protected-tool coverage found yet
No matching local secret-handling manifest was found for dnstwist. Nucleus package metadata is still published here so future coverage has a stable package URL.
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Installs with 4 runtime dependencies.
- Build metadata lists 1 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
dnstwist | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version20250130
manager updated2026-06-15
local dataok
upstreamnot checked
latest detectednot detected
- infoRelease/tag comparison is only available for GitHub repositories.https://dnstwist.itnone confidence
install metadata
Package metadata
| Package key | brew:dnstwist |
|---|---|
| Version | 20250130 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/dnstwist |
| Homepage | https://dnstwist.it |
| Repository | https://github.com/elceef/dnstwist |
| Upstream docs | https://github.com/elceef/dnstwist#readme |
| License | Apache-2.0 |
| Source archive | https://files.pythonhosted.org/packages/e7/0e/88b4c5c7f3077c0d2e8544a14e321fce80b3cf0148a46dec9724e27c61d3/dnstwist-20250130.tar.gz |
| Last updated | 2026-06-15T10:20:15-04:00 |
| Pulse | updated |
| Dependencies | certifi, libmaxminddb, python@3.14, ssdeep |
| Build dependencies | rust |
| Uses from macOS | libffi |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | dnstwist |
| Version Scheme | 0 |
| Revision | 11 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
dnstwist 0~20250130-1
Domain name permutation engine
https://github.com/elceef/dnstwist
sudo apt install dnstwist- Section: net
- Architecture: all
- 1 dependencies
- 11 optional deps
- normalized package name match
- Matched by: Dnstwist
Nix95%
dnstwist
nix profile install nixpkgs#dnstwist- normalized package name match
- Matched by: Dnstwist
Ubuntu apt95%
dnstwist 0~20240116-1
Domain name permutation engine
https://github.com/elceef/dnstwist
sudo apt install dnstwist- Section: universe/net
- Architecture: all
- 1 dependencies
- 11 optional deps
- normalized package name match
- Matched by: Dnstwist
apk95%
dnstwist 20250130-r1
Domain name permutation engine
sudo apk add dnstwist- License: Apache-2.0
- Architecture: x86_64
- Source Package: dnstwist
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Dnstwist
apk95%
dnstwist-dictionaries 20250130-r1
Dictionaries for dnstwist
sudo apk add dnstwist-dictionaries- License: Apache-2.0
- Architecture: x86_64
- Source Package: dnstwist
- normalized package name match
- Matched by: Dnstwist
apk95%
dnstwist-pyc 20250130-r1
Precompiled Python bytecode for dnstwist
sudo apk add dnstwist-pyc- License: Apache-2.0
- Architecture: x86_64
- Source Package: dnstwist
- 1 dependencies
- normalized package name match
- Matched by: Dnstwist
dnf95%
dnstwist 20250130-4.fc44
Domain name permutation engine
https://github.com/elceef/dnstwist/
sudo dnf install dnstwist- License: Apache-2.0
- Category: Unspecified
- Architecture: noarch
- Source Package: dnstwist
- 3 dependencies
- 1 provides
- normalized package name match
- Matched by: Dnstwist
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment