> For the complete documentation index, see [llms.txt](https://osintverse.gitbook.io/otinstaller/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osintverse.gitbook.io/otinstaller/tools/dnstwist.md).

# Dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation.

## Source

* Repository: <https://github.com/elceef/dnstwist>
* License: Apache-2.0

## Install

```bash
otinstaller install dnstwist
```

otinstaller installs the pip package `dnstwist` pinned to version `20250130` in a dedicated virtualenv.

## Credentials

No API keys needed.

## Input types

| Input        | Typed input     | Tool arguments             |
| ------------ | --------------- | -------------------------- |
| domain (`d`) | `d:example.com` | `example.com` (positional) |

## Example output

Illustrative output showing the general shape of a run. Real output depends on the tool version and the target.

```
dnstwist 20250130 output for example.com (truncated):

homoglyph      exɑmple.com     -
homoglyph      exámple.com     144.126.215.83
hyphenation    ex-ample.com    104.21.32.188 2606:4700:3031::6815:20bc
hyphenation    e-xample.com    172.67.130.200 2606:4700:3035::6815:902
insertion      dexample.com    185.143.233.131
insertion      4example.com    13.248.169.48
omission       exaple.com      104.247.81.99
omission       eample.com      13.248.169.48
replacement    esample.com     104.21.56.168 2606:4700:3033::6815:38a8
replacement    ecample.com     104.21.83.125 2606:4700:3035::6815:537d
replacement    exsmple.com     13.223.25.84 2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
transposition  exapmle.com     103.224.182.243
transposition  exmaple.com     104.18.75.230 2606:4700::6812:4ae6
transposition  examlpe.com     13.223.25.84 2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
subdomain      e.xample.com    -
vowel-swap     ixample.com     13.248.169.48
vowel-swap     exumple.com     66.29.148.123
various        examplecom.com  54.243.117.197 2600:1f18:4ae:c605:dd5d:b838:5816:d7fb
```

## Run

Plain arguments after `--` are passed to the tool unchanged:

```bash
otinstaller run dnstwist -- example.com
```

Typed inputs are mapped to this tool's flags:

```bash
otinstaller run dnstwist d:example.com
```

Results are saved to `./results/dnstwist/<target>/`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://osintverse.gitbook.io/otinstaller/tools/dnstwist.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.