dnstwist_scan
Identify typosquatting and phishing domains by generating domain name variations and checking registration status, with optional MX record analysis.
Instructions
Detect typosquatting and phishing domains using dnstwist.
Generates permutations of a domain name (homoglyphs, additions, deletions, substitutions) and checks which ones are registered, helping identify potential phishing or brand abuse domains.
Args: domain: Target domain to check (e.g. "example.com"). threads: Number of DNS query threads (default 10). registered_only: Only return registered/live domains (default True). check_mx: Check MX records to identify phishing-ready domains. timeout: Override scan timeout in seconds.
Returns: List of suspicious domain permutations with registration status.
Note: - Target domain must be in tengu.toml [targets].allowed_hosts. - Passive OSINT — only sends DNS queries, no HTTP requests.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| threads | No | ||
| timeout | No | ||
| check_mx | No | ||
| registered_only | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||