Monitoring lookalike domains of your own brand with dnstwist

Why lookalikes matter

Once your domain enforces DMARC, attackers impersonate it with lookalikes such as examp1e.org, example-support.com, or exarnple.org. These pass authentication for their own domain, so detection depends on knowing which variants exist and watching them.

dnstwist

dnstwist generates permutations using techniques such as character omission, repetition, swap, homoglyphs, added hyphens, and alternate TLDs, then resolves each to show which are registered, with A, MX, and name server records. Variants with MX records can send and receive mail and deserve priority.

python3 -m pip install --user dnstwist
dnstwist --registered --mxcheck --format csv example.org > lookalikes.csv
cut -d, -f1,2,4,5 lookalikes.csv | column -t -s, | head -30

Lab: prioritize your own lookalikes

Run dnstwist against a domain you own. Filter to registered variants, then sort them: highest priority for variants with MX records or a page resembling your login, medium for parked domains, and low for unrelated businesses. For the top items, check registration date and certificate history. Add the top variants to a watch list in your mail gateway and threat intelligence platform.

• MX present: can send mail as the lookalike
• Login page clone: immediate takedown request
• Parked: monitor for changes
• Legitimate unrelated business: note and ignore

Acting on findings

Report abusive domains to the registrar and hosting provider with evidence, and use a takedown service if you have one. Consider defensively registering the most likely typos of your main domain. Re-run the scan regularly or subscribe to newly registered domain feeds containing your brand.