Best dnstwist alternatives

Pick by the job you need#

• Another local engine. URLCrazy adds word-level misspellings, homophones and plural forms. urlinsane adds multilingual variants and package and username checks, if you build its unreleased engine from source. DNSRazzle adds SSIM screenshot scoring for many brands in one run. ^1–21
• A keyword feed instead of permutations. openSquat matches brand keywords against a daily feed of newly registered domains. ^22–32
• A browser scan with no install. CIRCL Typosquatting finder scans without an account and exports to MISP. ^33–37
• Scheduled alerts. dnstwister and CheckPhish email you when lookalikes of your domain appear. Have I Been Squatted adds certificate transparency, newly registered domains and rules that act on a match. Silent Push fits when lookalike monitoring sits inside wider infrastructure investigations. ^38–50

Stay on dnstwist when a local scan already does the job. Marcin Ulikowski's open-source and free CLI, under Apache-2.0, generates a wide, tested fuzzer set. It covers QWERTY, QWERTZ and AZERTY keyboard layouts, bitsquatting, per-TLD IDN glyph rules, and dictionary and TLD files. Optional flags add WHOIS creation date and registrar, HTTP and SMTP banners, an --mxcheck probe, and HTML and screenshot similarity percentages. Results go to CSV, JSON, a bare list or the Python API, lookups can use DoH or custom resolvers, and --screenshots saves PNG files. The maintainer lists integrations in other products, among them a Splunk add-on and Maltego, and dnstwist.it runs a quick check with no login. The latest release is from January 2025. Have I Been Squatted vs dnstwist ^9,17,51–60

This page covers a selection of tools that generate or find lookalike candidates for a domain you name. Order is editorial. Local tools come first, then hosted checks, then hosted monitoring.

1. Local scan

   Generates permutations of the domains you supply, on your machine

   • dnstwist (the incumbent)
   • URLCrazy
   • urlinsane (newest engine unreleased)
   • ail-typo-squatting (CIRCL library)
   • DNSRazzle (wraps dnstwist)

   You supply the schedule and storage

2. Keyword feed match

   Matches a feed of newly registered domains to brand keywords

   • openSquat

   You supply keywords and a schedule

3. Hosted check

   Runs permutations in a browser with no install

   • Typosquatting finder (CIRCL)
   • dnstwister
   • dnstwist.it (dnstwist's own page)
   • Have I Been Squatted (sign-in needed)

   You repeat checks by hand

4. Scheduled monitoring

   The service repeats checks and sends alerts

   • dnstwister
   • CheckPhish
   • Silent Push
   • Have I Been Squatted

   You sign up and review alerts

Components for your own pipeline

• crt.sh
• CertStream
• Phishing Catcher (scores CertStream names)

Certificate transparency data that your own code matches against your brand.

Shortlist#

Certificate components have their own section below.

dnstwist alternatives compared on what each adds, how you get it and the main trade-off, from local tools to hosted monitoring.

	Best for	How you get it	Trade-off
URLCrazy
URLCrazy	Local scan with word-level misspellings and plural forms1–3	Public source; custom Restricted license1,61–64	Bundled TLD and IP data from April 202065–66
urlinsane
urlinsane	Local scan with multilingual variants4–8	Open source and free4,67–70	Rewritten engine is unreleased; build from source4,15–16
DNSRazzle
DNSRazzle	Local scan with SSIM screenshot scoring9,17–19	Open source and free18,20–21,71–73	MX check sends real SMTP messages by default74–75
openSquat
openSquat	Local keyword match against a daily new-domain feed22,76	Open source and free77–78	Default feed permits personal and research use only30
CIRCL Typosquatting finder
CIRCL Typosquatting finder	Browser scan with MISP export35–37	Free public web service33–34,79–80	One-shot scan interface80–82
dnstwister
dnstwister	Daily A and MX alerts on similar names38	Public self-serve subscription38	Hosted alerting cannot be self-hosted83
CheckPhish
CheckPhish	Typosquat monitoring with email alerts39–41	Free account40,84–85	Weekly scan cadence39–40,84,86
Silent Push
Silent Push	Impersonation search inside a threat intelligence platform47	Quote-based contract87–89	Hosted platform only90
Have I Been Squatted
Have I Been Squatted	Scheduled monitoring with rules that alert, block or request Takedowns44–46,91–92	Self-serve monitoring subscription42,93	Hosted service94

Monitoring side by side#

The four hosted monitors differ in how often they check, where alerts go and what you can do with a match.

Hosted monitors compared on cadence, alert destinations and what you can do after a match.

	Cadence	Alerts go to	After a match
dnstwister
dnstwister	About every 24 hours95–98	Email and RSS, with IP and CIDR muting95–97	CSV export and STIX 2.1 indicator downloads38,95,99–103
CheckPhish
CheckPhish	Weekly variant scans39–40,84,86	Email41,84,104	URL scan with dispositions such as phish and scam41,85,105–106
Silent Push
Silent Push	Monitors every 24 hours; Assets Impersonation down to every 5 minutes107–109	In-app, email, Slack, Teams or webhook107,110–113	Pivots into shared DNS, WHOIS, favicon and banner infrastructure48–50
Have I Been Squatted
Have I Been Squatted	Stated at least once every 24 hours42	Slack, webhooks, SIEMs such as Splunk and Sentinel, and an email digest44–46,91–92	Blocks in tools such as Zscaler and Defender, or a Takedown request44–46,91–92

URLCrazy#

Best for penetration testers and analysts who want Wikipedia misspellings, homophones, singular and plural forms and a wide TLD swap from one local Ruby command. Not for teams that need a registration check in the same run, because the README states that the tool does not check whether a domain is registered. ^1–3,65,114

URLCrazy's Wrong TLD method swaps in each of 1,513 bundled TLDs, plus country second-level domains. It resolves A, MX and NS records, and -r skips DNS. Four keyboard layouts, QWERTY, AZERTY, QWERTZ and Dvorak, help when the brand serves users in different regions. Output goes to CSV or JSON. The optional -p flag fetches search-engine result counts, which the maintainer presents as an estimate of a typo's relative popularity. Andrew Horton maintains the URLCrazy repository. The README dates first publication to 2009, the latest release, 0.8.2, is from July 2025, and Kali, Parrot, BlackArch and the AUR package it. ^{1–3,61–62,64–65,114–123}

The license is a custom Restricted license, not an OSI-approved one. It allows use and distribution, but modified versions need the maintainer's permission, and a commercial service other than penetration testing, such as domain protection for clients, needs a separate license. Prefer URLCrazy for word-level misspellings and TLD breadth. Prefer dnstwist for an Apache-2.0 license, --whois, --mxcheck or page-similarity percentages. Have I Been Squatted vs URLCrazy ^{1–3,9,17,51,53,55–58,61–65,114}

A URLCrazy run against haveibeensquatted.com on November 4, 2026 reported 2,229 hostnames to process. The excerpt shows the original and four candidates with their typo type, address and country, then the name and mail servers of three names. ^{1–2,61–62,66,116,118,124}

$ urlcrazy -n haveibeensquatted.com
URLCrazy Domain Report
Domain    : haveibeensquatted.com
Keyboard  : qwerty
At        : 2026-11-04 23:58:00 +0100
# Please wait. 2229 hostnames to process

Typo Type           Typo Domain                  IP                    Country
Original            haveibeensquatted.com        2606:4700::6812:13f5
Character Omission  haveibeensquated.com
Character Repeat    haveibeeensquatted.com
Wrong TLD           haveibeensquatted.dev        76.76.21.21           UNITED STATES (US)
Wrong TLD           haveibeensquatted.ws         64.70.19.203          UNITED STATES (US)

Typo Domain               NameServer                 MailServer
haveibeensquatted.com     nile.ns.cloudflare.com     alt2.aspmx.l.google.com
haveibeensquated.com      carlane.ns.cloudflare.com
haveibeeensquatted.com    may.ns.cloudflare.com      route3.mx.cloudflare.net

URLCrazy compared with dnstwist on word-level variants, page similarity and license.

	URLCrazy	dnstwist
Word-level variants
Word-level variants	Common Misspellings, Homophones, Singular or Pluralise1–3	Plural fuzzer51
Page similarity
Page similarity	Not found: Not found61,116	Yes: ssdeep/TLSH HTML and screenshot perceptual hashes9,17,51,56
License
License	Custom Restricted license1,61–64	Apache License 2.053,55

urlinsane#

Best for engineers who build from source and want multilingual domain variants plus package and username squat checks, for example as a CI gate on dependency names. Not for readers who need a released binary of the rewritten engine. The newest release, 0.8.2, is from November 2024. ^4–16,69

urlinsane's rewritten engine must be built from public GPL-3.0 source. The released 0.8.2 binary uses the earlier pipeline. The rewrite lists 32 algorithms, including same-language and cross-language homophones, number words and 133 keyboard adjacency sets, plus delegated-subdomain variants and full public-suffix TLD swaps. It generates variants of email addresses, packages, usernames and repository names, checks whether packages and usernames exist, and runs a dependency-confusion analyzer. Three-state results keep a failed lookup from reading as a free name. Clusters group results by shared address, nameserver or registrant, with Graphviz output. For CI, --fail-on exits with code 2, output is deterministic, incomplete scans are marked PARTIAL, and NDJSON is written when a scan completes. The maintainer last committed to the urlinsane repository in August 2026 and publishes long-form documentation of the attack and the engine. ^{4–16,67–70,125–136}

Each run takes one target, and the automation guide shows cron and CI schedules. The CLI reference calls the engine mid-rewrite and lists flags that are specified but not built, among them --resume and graph diffing. Prefer urlinsane when broader target types justify building an unreleased engine. Prefer dnstwist when you need a released binary with page-similarity scores. Have I Been Squatted vs urlinsane ^{4,9,17,51,53,56,59–60,67,69}

urlinsane compared with dnstwist on target kinds, engine release state, clustering and page similarity.

	urlinsane	dnstwist
Targets beyond domains
Targets beyond domains	Email, packages, usernames and repositories4,9–14	One domain per run51,56,137
Release state
Release state	Rewritten engine is unreleased; latest binary November 20244,15–16	Released on PyPI and GitHub; latest January 202553,59–60
Shared infrastructure
Shared infrastructure	Yes: Clusters on address, nameserver or registrant4,133	Not found: Not found51,56
Page similarity
Page similarity	ssdeep in 0.8.2 only; not in master composition125,138	Yes: HTML fuzzy hashes and screenshot hashes9,17,51,56

DNSRazzle#

Best for teams that want dnstwist's permutations plus local SSIM screenshot scoring, RDAP lookups and optional nmap and dnsrecon reports, for many brands in one run. Not for anyone who needs new engine features. Version 2.0.0, released in April 2026, is the final feature release, and the maintainer names SecurityShrimp Highlander, a separate commercial product, as its replacement. ^{9,17–21,72,139–144}

DNSRazzle extends dnstwist rather than replacing its engine. It imports dnstwist==20201228, which lacks the cyrillic and plural fuzzers of current dnstwist, and adds a url-encoded-slash permutation for %2F link tricks. -d or -f take many domains in one run. Playwright captures viewport screenshots and scores them against the original with SSIM. The tool can write a threshold-based blocklist and email a CSV report through your SMTP server. For each lookalike its screenshot step selects, it can run nmap -A -sV and a dnsrecon report with SOA, SRV, SPF ranges, crt.sh subdomains and a DNSSEC zone walk. ^{9,18–21,74–75,140–142,145–146}

The MX interception test (mx-spy) runs on every permutation with an MX record. It is on by default, sends a real SMTP message to third-party mail servers, and no flag turns it off. Talks at Kernelcon 2022 and the Health-ISAC Fall Americas summit in 2021 describe its use by the security team at Baxter Healthcare. The DNSRazzle repository is under Apache-2.0. Use DNSRazzle when SSIM scoring and multi-domain batches matter more than a current engine. Stay on current dnstwist for newer fuzzers. Have I Been Squatted vs DNSRazzle ^{21,51,72–75,141,145,147–149}

DNSRazzle compared with dnstwist on engine age, screenshots, multi-domain runs and maintenance.

	DNSRazzle	dnstwist
Permutation engine
Permutation engine	Pinned dnstwist 2020122820,74,145	Current dnstwist releases53,59–60
Screenshot similarity
Screenshot similarity	SSIM on 1920x1080 viewport screenshots19,21	Yes: HTML fuzzy hashes plus screenshot perceptual hashes51,56–57
Many domains per run
Many domains per run	Yes: Comma list or file of domains20–21	One domain per run51
Maintenance
Maintenance	2.0.0 (April 2026) is the final feature release20	Latest release January 202553,59–60

openSquat#

Best for researchers who want to match brand keywords against a daily feed of newly registered domains on their own machine. Not for readers who need permutations of one named domain. openSquat matches keywords against a feed instead. ^22–28,76

openSquat downloads a daily feed of about 100,000 newly registered domains and runs Levenshtein matching against your keywords locally. A checksum file skips unchanged downloads. Homograph handling transliterates non-Latin characters to Latin before comparing, so a Cyrillic lookalike can match. Optional flags query Quad9, VirusTotal, a phishing list, ports 80 and 443, and crt.sh. Output is TXT, JSON or CSV, and the README shows a cron example. An API mode queries openSquat's hosted lookalike service per keyword and returns an IDN flag and Unicode rendering for each match. ^{22–32,150–156}

One maintainer keeps the GPL-3.0 code in the openSquat repository, with releases through October 2026. Version 2.3.1 treats phishing lists as untrusted input, and 2.3.0 stops API-key leaks on redirects. GitHub showed 989 stars and 163 forks in November 2026. The default feed permits personal and research use only. Pick openSquat for keyword matching on new registrations. Keep dnstwist when you start from one domain. Have I Been Squatted vs openSquat ^{23,30,51,56,77–78,137,157–159}

An openSquat 2.3.1 run on November 4, 2026 checked the keyword haveibeensquatted against a feed of 100,000 domains at the high-confidence threshold and flagged none. ^{22–32,155,160–162}

$ opensquat -k keywords.txt --dns -o results.txt -t txt
version 2.3.1
+---------- Checking Domain Squatting ----------+
[*] Downloading fresh domain list: https://feeds.opensquat.com/opensquat-nrd-latest.txt
[*] Download volume: 1.57 MB
[*] keywords total: 1
[*] Total domains: 100,000
[*] Threshold: high confidence
[+] Starting Domain Squatting verification for 'haveibeensquatted' [1/1]
+---------- Summary Squatting ----------+
[*] Domains flagged: 0
[*] Running time: 2.44 seconds

openSquat compared with dnstwist on discovery method, feed, page similarity and enrichment.

	openSquat	dnstwist
Discovery method
Discovery method	Levenshtein match of keywords against an NRD feed22–28	Yes: Generates permutations of one domain and resolves them51,56,137
Newly registered feed
Newly registered feed	Yes: Daily feed of about 100,000 domains22,29–32	Not found: Not found51,56–57
Page similarity
Page similarity	Not found: Not found24,76	Yes: HTML fuzzy hashes and screenshot perceptual hashes51,56–57
Optional enrichment
Optional enrichment	Quad9, VirusTotal, a phishing list, ports and crt.sh22,151–154	WHOIS plus HTTP and SMTP banners51

CIRCL Typosquatting finder#

Best for CSIRT-style teams that want a browser scan without an account, MISP export, or a BSD-licensed library that feeds AIL and other systems. Not for buyers who need recurring monitoring or durable investigation history. No public documentation of either was found for the service. ^{34–37,80–82,163}

CIRCL, the CERT for Luxembourg's private sector, communes and non-governmental entities, runs the Typosquatting finder as a public service, with EU co-funding through the JTAN action. Its library, ail-typo-squatting, ships 21 algorithms, including common misspellings, homophones and numeral swaps, and covers 1,441 bundled IANA TLDs plus public-suffix second levels. It can test each variation for catch-all DNS. The website compares page text and resources with the original and exports a MISP feed or a MISP JSON event. The AIL framework's tracker calls the library for typosquatting watches, and the library also emits YARA, regex and YAML rules. ^{33–37,79–82,163–174}

The BSD-2-Clause library and the Apache-2.0 website are both open source, so a team can self-host the whole service. pypistats reported 49,109 library downloads in the last month, a count that includes mirrors and CI. The latest PyPI release is from April 2025. On November 4, 2026, the hosted /api/<domain> route returned 500 while the browser form returned results, so retest before you integrate the REST route. Choose CIRCL for MISP export and a CERT-run page. Choose dnstwist for --mxcheck and screenshot hashes. Open the CIRCL Typosquatting finder. Have I Been Squatted vs CIRCL Typosquatting Finder ^{9,17,35–37,51,56–58,81,175–185}

CIRCL Typosquatting finder compared with dnstwist on hosted access, exports, mail checks and scheduling.

	CIRCL Typosquatting finder	dnstwist
Hosted check
Hosted check	Yes: Public web service, no account33–34	Yes: No-login page at dnstwist.it52
MISP and detection outputs
MISP and detection outputs	Yes: Native MISP feed and JSON event export35–37	CSV, JSON and bare list51,56–57,186
Mail checks
Mail checks	Lists MX records34,82,174	Yes: --mxcheck SPYING-MX probe51,57–58
Scheduling
Scheduling	One-shot scan interface80–82	One-shot CLI; you schedule it51

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

dnstwister#

Best for small portfolios that want daily A and MX alerts on similar names without running a CLI. Not for operators who must self-host the alerting service, or who need the public /api/ip/ endpoint without retesting it. ^{38,83,95–98,187}

dnstwister offers no-login search and hosted monitoring that alerts within 24 hours when a similar name gains a new A or MX record. Its engine is a modified copy of the dnstwist library. Email alerts and RSS feeds support follow-up, while IP and CIDR muting, a separate new-MX-only list and a newly_monitored flag for algorithm changes cut repeat noise. Each alert email ends with a link to manage the subscription. A keyless public API exposes the fuzzing and lookup endpoints, and indicator pages offer STIX 2.1 downloads. The news page records algorithm and incident changes in plain language. The open-source web app is Unlicense, and the hosted service code is private. ^{38,83,95–97,99–103,188–196}

On November 4 and 8, 2026, the status page listed open incidents for DNS resolution and delta calculations, and the live /api/ip/ endpoint returned "error":true for well-known domains. The browser-resolution endpoint returned an A record for google.com on November 4. Those checks cover the public API and the status page, not alert delivery. Prefer dnstwister for hosted daily alerts when the service is healthy. Prefer upstream dnstwist for local control, --mxcheck and screenshot hashes. Have I Been Squatted vs dnstwister ^{9,17,51,56–58,97,187,189,197–199}

dnstwister compared with dnstwist on engine lineage, alerts, exports and DNS resolution model.

	dnstwister	dnstwist
Engine
Engine	Modified copy of dnstwist188	Upstream permutation CLI51,53
Daily alerts
Daily alerts	Yes: Alerts within 24 hours of new A or MX on similar names38	One-shot CLI; you schedule it51
Exports
Exports	Yes: CSV search export; STIX 2.1 indicator downloads38,95,99–103	Yes: CLI, CSV, JSON and list output51,56–57,186
DNS resolution model
DNS resolution model	Hosted public DNS API endpoints97,187,189,197,199	Local lookups against nameservers you choose51,60

CheckPhish#

Best for analysts who want a URL sandbox plus hosted typosquat monitoring with email alerts. Not for teams that need daily lookalike scans, because monitoring scans typosquat variants weekly. ^{39–41,84,86,105–106}

Bolster runs CheckPhish. Monitoring generates typosquat variations of your domain, live-scans them and sends email alerts. A live URL scan returns a screenshot, DOM and WHOIS data. The API documents dispositions beyond phishing, such as scam, adult and cryptojacking, and lets you choose the scanner's user agent. Ready-made integrations include a Microsoft Security Copilot plugin, with third-party Splunk SOAR and Tines listings. Managed takedowns are part of the wider Bolster platform. Use CheckPhish when a hosted sandbox and weekly alerts fit. Use dnstwist for local runs and similarity percentages. Open the CheckPhish homepage. ^{9,17,39–41,51,53,55–56,84–86,104–106,200–205}

CheckPhish compared with dnstwist on scheduled monitoring, classification, integrations and local control.

	CheckPhish	dnstwist
Scheduled monitoring
Scheduled monitoring	Weekly variant scans39–40,84,86	One-shot CLI; you schedule it51
Phishing disposition
Phishing disposition	API dispositions such as phish, likely_phish and clean41,85,105–106	Not found: Not found51,56
Integrations
Integrations	Security Copilot plugin; Splunk SOAR and Tines listings202–205	Maintainer lists Splunk, Maltego and others56
Local control
Local control	Run by Bolster200	Yes: Self-hostable Apache-2.0 CLI53,55–56

Silent Push platform#

Best for threat intelligence and SOC teams that need Domain Impersonation as one module inside a wider internet-scan platform. Not for readers who want a local permutation CLI. Silent Push is a hosted platform. ^47,88,90

Choose Silent Push when a lookalike investigation needs pivots into shared DNS, WHOIS, favicon and banner infrastructure. Domain Impersonation takes a target domain, with options for typosquat mode, digit homoglyphs and subdomain search. Assets Impersonation searches a list of owned domains or IPs on five-minute, hourly or daily schedules. Monitors rerun saved queries every 24 hours and alert in the app, by email, Slack, Teams or webhook. Favicon and HTML title impersonation queries and ssdeep HTML similarity compare page content. ^{47–50,107–113,206–208}

Context Graph Search runs SPQL over Silent Push's own scans of web, banner, open-directory and WHOIS data. SPQL is in alpha. Passive DNS and WHOIS history sit beside third-party passive DNS views from Farsight and Zetalytics. Fingerprint pivots cover favicon Murmur3 hashes, ssdeep, JARM and banners. Silent Push states that Traffic Origin reveals the country behind proxy and VPN connections. For threat-actor work, it offers Indicators of Future Attack (IOFA) and APT feeds, TLP:AMBER reports and on-demand analyst services. It lists 20 SIEM, SOAR and TIP integrations, plus TAXII. Choose dnstwist for an unlimited local scan. Have I Been Squatted vs Silent Push ^{49–50,53,55–56,113,206,208–224}

Silent Push compared with dnstwist on impersonation search, pivots, scheduled alerts and page similarity.

	Silent Push	dnstwist
Lookalike discovery
Lookalike discovery	Domain and Assets Impersonation queries49,108,112	Yes: Local permutation generation and DNS resolution51,56,137
Investigation pivots
Investigation pivots	Yes: Context Graph Search across PADNS, WHOIS, favicon and banners48–50	Not found: Not found51,56
Scheduled alerts
Scheduled alerts	Monitors alert in-app, by email, Slack, Teams or webhook107,110–113	One-shot CLI; you schedule it51
Page similarity scores
Page similarity scores	Favicon and HTML title impersonation; ssdeep HTML similarity206–208	Yes: HTML fuzzy hashes and screenshot perceptual hashes51,56–57

Have I Been Squatted#

Best for teams that want permutations, certificate transparency and newly registered domains checked on a schedule they do not have to run, with rules that alert, block or request a Takedown. Not for teams that must self-host the scanner. ^{42–46,93–94}

Have I Been Squatted starts from lookalikes of your domains and goes on to the malicious infrastructure behind them, with scheduled Domain Monitoring, enrichment and rules. It states that lookups run at least once every 24 hours, starting minutes after you add a domain. Permutations are built on the open-source engine twistrs, whose README states a goal of porting dnstwist. Have I Been Squatted states that newly registered domains come from gTLD zone files for the past 30 days. Enrichment includes RDAP registration data, DNS records, open ports, page semantics, favicon hashes and HAR captures, and the rule catalog lists 173 domain signals. Each result shows whether the lookalike is set up for email, and an analyst can open a live page in an isolated browser session. ^{9,17,42–43,93–94,225–233}

Rules raise alerts with statuses such as Active, Resolved, Ignored and False Positive, and digests run daily, weekly or monthly. A rule can also deliver a finding to a SIEM, push a domain to Network Enforcement, mark a result Malicious with a note or request a Takedown. An analyst reviews every Takedown request. Connectors reach Slack, webhooks and named SIEMs, and the MCP server and Slack app need an organization admin for writes. The hunting tools run ad-hoc Typosquat and Analyze lookups, and the Analyzer runs a one-off domain analysis without a login. ^{17,43–46,91–93,233–241}

Teams that script dnstwist today can keep scripting. The Public API streams lookup, analyze and certificate transparency search results as NDJSON, with scoped API keys and a Python SDK. Discover adds the names that are still open, listing unregistered permutations of your domain that could be used for phishing or brand impersonation. ^{17,233,238,240,242}

Have I Been Squatted does not compute full-page visual similarity against your real site. It fingerprints favicons instead. Stay on dnstwist for local fuzzing, --mxcheck and page-similarity percentages. ^{9,17,51,56–58}

Have I Been Squatted compared with dnstwist on discovery sources, scheduling, page similarity and response.

	Have I Been Squatted	dnstwist
Finding lookalikes
Finding lookalikes	Yes: Permutations, CT, newly registered domains, business context42–43	Yes: Permutations of one domain, resolved in one run51,56,137
Schedule
Schedule	Stated at least once every 24 hours42	One-shot CLI; you schedule it51
Page similarity
Page similarity	Favicon fingerprints9,17	Yes: ssdeep/TLSH HTML and screenshot hashes9,17,51,56
After a match
After a match	Slack, webhooks, SIEMs, blocking, Takedown requests and email digests44–46,91–92	Not found: Not found51,56

Components and combinations#

crt.sh and CertStream supply certificate transparency data to a lookalike pipeline, and Phishing Catcher scores names from the CertStream feed. You supply the brand list, the matching and the alerts around them. No public documentation of lookalike generation for a named domain was found for any of the three. ^243–254

crt.sh#

Sectigo operates crt.sh as a free certificate search with no account. It searches identities you supply and pivots by certificate hash, SPKI hash, subject hash, serial or CA. Guest PostgreSQL access, JSON and Atom output support scripting. The schema, monitors and front end are open source under GPL-3.0. The site also carries CA compliance data, such as certificate linting, root program disclosures and the health of more than 130 monitored CT logs. On November 4, 2026, its Atom feed for haveibeensquatted.com returned 327 entries in 5.2 seconds, while some same-day rechecks returned HTTP 502. In checks from November 4 to 9, 2026, its guest database and web search were more than two weeks behind the CT logs and missed certificates issued in late October, so check how current the results are before you rely on them. Sectigo's terms restrict automatic access and non-personal use, so read them before you script against the site. Pair crt.sh with dnstwist when you already have candidate names, or with openSquat's optional crt.sh enrichment. ^{22,151–154,243,252–262}

CertStream#

CertStream streams new certificate transparency entries over a WebSocket as JSON. Every entry carries the raw wildcard and SAN names, so a consumer can match any hostname pattern. Client libraries cover Python, JavaScript, Go and Java, and the Python client reconnects automatically, though the server keeps no history and reconnects do not replay missed entries. The maintainer describes the public server as a demo for proofs of concept. On November 8, 2026, it accepted WebSocket connections but sent no entries in 45 seconds, and its /latest.json still held entries from October 31, 2025. Self-host the MIT server or the community certstream-server-go fork instead. The fork runs as a single binary or Docker image, with a published resource profile, Prometheus metrics and static CT log support, and its latest release, v1.10.1, is from September 2026. Third-party tools consume the format, Phishing Catcher among them. ^{244–247,263–275}

Phishing Catcher#

Phishing Catcher is a GPL-3.0 Python proof of concept. It scores certificate names from the CertStream feed against editable YAML keywords and visible rules, then writes matches to the console and a name-only local log. The rules score confusable characters, one-edit typos of high-score keywords, fake .com- labels and deep nesting such as paypal.com.security.accountupdate.gq. The default list holds 64 brand and service keywords, so one run watches many brands. The repository has 1,832 stars and 358 forks, and TrustRadius lists it among the tools most compared with dnstwist, and an issue in the repository says certleak was inspired by it. The authors of an ARES 2021 paper adapted its scoring as a baseline for trained phishing classifiers. The script hard-codes the public CertStream endpoint, which sent no entries in a November 2026 test, so it needs a one-line edit to read a self-hosted server. The last commit on master dates from December 2020, and there are no releases. Choose it only if you intend to maintain the certificate-feed pipeline yourself. ^{247–251,267–270,276–287}

Choose by need#

• Keep dnstwist for a local permutation scan with page-similarity scores and --mxcheck. ^{9,17,51,53,55–58}
• Word-level misspellings and TLD breadth: URLCrazy. Multilingual, package and username variants from an engine you build from unreleased source: urlinsane. ^{1–16,65,114}
• Screenshot scoring for many brands in one run: DNSRazzle. ^9,17–21
• Newly registered domain keyword matching: openSquat. ^22–32
• MISP export or YARA rules from a CERT-run engine: CIRCL Typosquatting finder. ^{35–37,163,167}
• Daily email and RSS alerts: dnstwister. Weekly typosquat alerts beside a URL sandbox: CheckPhish. ^{39–40,84,86,95–98,105–106}
• Lookalikes inside wider infrastructure investigations: Silent Push. ^47–50
• Monitoring with rules that alert, block or request a Takedown, plus a Public API for your scripts: Have I Been Squatted. ^{43–46,93,238,240,242}
• Certificate data for your own pipeline: crt.sh or CertStream. ^243–246

Is Have I Been Squatted right for you?#

It fits teams that no longer want to schedule, store and compare scans themselves. Domain Monitoring checks permutations, certificate transparency and newly registered domains continuously, and rules can alert, send the finding to a SIEM, block the domain or request a Takedown. From a lookalike, Atlas investigations, in early access, pivot across shared infrastructure to the related domains behind it. Scripts keep working through the Public API and its Python SDK. Have I Been Squatted does not monitor social media, app stores, dark web content or ads. ^{17,42–46,91–93,230–231,238,240,242,288–291}

Domain Monitoring, hunting tools, rules and alerts are self-serve with a free trial. Takedowns and the email, network, SIEM and canary products are bought through sales. ^42,93,292

FAQ#