Lion Cipher Lab
Hunt typosquatting and phishing lookalikes of your domain with dnstwist
- Threat Intel Analyst
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Somebody, right now, can register a domain that is one keystroke away from yours — l0gin-yourbank.com, yourbank.co, the Cyrillic-a version that is pixel-for-pixel identical to the real name — and stand up a copy of your login page behind it. The first most organisations hear of it is when an employee has already typed their password into it. There is a cheaper outcome available, and it is free: instead of waiting to be told which lookalike an attacker chose, you enumerate the space of plausible lookalikes yourself and check which ones are already registered, so the dangerous ones are on your…
What you'll learn
- what a domain-permutation engine is and why enumerating lookalikes is proactive where certificate monitoring is reactive
- installing dnstwist by pip, pipx, Homebrew or the official Docker image, and confirming the version
- reading the fuzzer column: telling a plausible human typo from a bitsquat artefact, a homoglyph, a hyphenation, a TLD-swap and a combosquat
- recognising an IDN homograph attack and decoding a punycode (xn--) name before judging it
- cutting a four-thousand-name permutation list down to only the permutations that are actually registered
- using the MX column to promote a mail-capable lookalike, because mail capability is the setup for credential phishing and business email compromise
- spotting a visual or HTML clone of the real site with fuzzy hashing (--lsh) and perceptual screenshot hashing (--phash)
- exporting a machine-readable watchlist with --format csv / json so the result feeds another tool instead of dying in a terminal
- triaging registered-but-not-necessarily-malicious: telling a defensive registration or a parked domain from a live impersonation, with a written verdict
- mapping the finding to MITRE ATT&CK T1583.001, T1584 and phishing T1566
Steps in this lab
- The gap dnstwist fills — and the vocabulary of a lookalike
- STOP — the rules of engagement, before you generate anything
- Install dnstwist
- Generate the permutation space — and read the fuzzer column
- Narrow it: which permutations actually EXIST, and which can take mail
- Enrich and export: visual clones, and a watchlist a machine can read
- Triage: registered is not the same as malicious
- The pro move — schedule it, diff it, and pair it with the sensor it cannot replace