# Install dnstwist with Homebrew, apk, apt, dnf, Nix Test domains for typo squatting, phishing and corporate espionage. Version 20250130 via Homebrew; verified 2026-06-15. Also installable with debian: sudo apt install dnstwist. ## Install ```sh sudo av install brew:dnstwist ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install dnstwist ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add dnstwist ``` Evidence: Alpine Linux edge package indexes: dnstwist from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install dnstwist ``` Evidence: Debian stable package indexes: dnstwist from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install dnstwist ``` Evidence: Fedora Rawhide package metadata: dnstwist from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#dnstwist ``` Evidence: nixpkgs package indexes: pkgs/by-name/dn/dnstwist/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:dnstwist - **Package manager:** Homebrew - **Version:** 20250130 - **Source summary:** Test domains for typo squatting, phishing and corporate espionage - **Homepage:** - **Last updated:** 2026-06-15T10:20:15-04:00 - **Generated:** 2026-08-03T19:37:03+00:00 ## Executables - dnstwist (alias) ## Install behavior - Bottle: not available ## Freshness - Page generated: 2026-08-03 - Package-manager version: 20250130 ## Project history and usage dnstwist is a domain permutation and phishing-domain scanner used for typosquatting, homograph, brand impersonation, and targeted threat-intelligence workflows. It turns the old manual question of 'what lookalike domains exist?' into a repeatable CLI, API, and web workflow. ### Project history The GitHub repository was created in June 2015, and the first GitHub release, v1.00, was published in October 2015. The official README presents the tool as a way to find lookalike domains that adversaries can use for typosquatting, phishing, fraud, and brand impersonation. Over time dnstwist grew beyond simple domain permutation. The README documents Unicode and homoglyph handling, dictionary and TLD permutation files, multithreaded lookups, fuzzy HTML similarity with ssdeep or TLSH, screenshot similarity with pHash, rogue MX detection, GeoIP, CSV/JSON export, a Python API, Docker images, and the dnstwist.it web scanner. ### Adoption history dnstwist has unusually strong adoption for a command-line security tool. The README documents installation through pip, Git, Debian/Ubuntu/Kali, Fedora, AUR, Homebrew, and Docker, and says the scanner is used by SOC and incident-response teams, independent analysts, and many named security products and services. ### How it is used Users run dnstwist against a domain, often with --registered to reduce the output to live domains, then inspect DNS, MX, GeoIP, web similarity, screenshot similarity, or exported CSV/JSON results. The tool can also be imported from Python through dnstwist.run for automated monitoring or enrichment pipelines. ### Why package nerds care dnstwist is package-nerd significant because it packages a security research workflow into a normal installable CLI while still offering optional heavyweight capabilities such as GeoIP databases, headless Chromium screenshots, fuzzy hashing libraries, Docker images, and a web scanner. ### Timeline - 2015: GitHub repository created. - 2015: First GitHub release, v1.00, published. - 2025: Release 20250130 published. - 2025: GitHub metadata shows continued repository activity. - 2026: Homebrew still carries dnstwist as a packaged security CLI. ### Related projects - The README names ssdeep, TLSH, pHash, GeoIP2, and Chromium as optional analysis components. It also lists integrations or downstream use in Splunk, SpiderFoot, Maltego, Intel Owl, CISA Crossfeed, Rapid7 InsightConnect SOAR, Palo Alto Cortex XSOAR, Fortinet FortiSOAR, and other security platforms. ### Sources - - - - - ## Security Notes No matching local secret-handling manifest was found for dnstwist. Nucleus package metadata is still published here so future coverage has a stable package URL. ## Other Package-Manager Records - Debian apt - dnstwist - 0~20250130-1: normalized package name match | Debian stable package indexes: dnstwist from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Domain name permutation engine | https://github.com/elceef/dnstwist - Nix - dnstwist: normalized package name match | nixpkgs package indexes: pkgs/by-name/dn/dnstwist/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - dnstwist - 0~20240116-1: normalized package name match | Ubuntu 24.04 LTS package indexes: dnstwist from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Domain name permutation engine | https://github.com/elceef/dnstwist - apk - dnstwist - 20250130-r1: normalized package name match | Alpine Linux edge package indexes: dnstwist from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Domain name permutation engine | https://dnstwist.it - apk - dnstwist-dictionaries - 20250130-r1: normalized package name match | Alpine Linux edge package indexes: dnstwist-dictionaries from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Dictionaries for dnstwist | https://dnstwist.it - apk - dnstwist-pyc - 20250130-r1: normalized package name match | Alpine Linux edge package indexes: dnstwist-pyc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Precompiled Python bytecode for dnstwist | https://dnstwist.it - dnf - dnstwist - 20250130-5.fc45: normalized package name match | Fedora Rawhide package metadata: dnstwist from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Domain name permutation engine | https://github.com/elceef/dnstwist/ ## Combined YAML source View the package source record on GitHub. [combined/dnstwist.yml](https://github.com/mxcl/pkgdb/blob/main/combined/dnstwist.yml) ## Sources - pkg.so package database - Geiger risk classifier - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph