dnstwist is an open-source Python tool by Marcin Ulikowski that generates permutations of a seed domain and checks which ones resolve. It’s excellent for one-off audits. DomainScan runs the same permutation engine continuously, enriches each hit with WHOIS registration date, resolving IP, MX record, SSL certificate, and abuse score, and alerts you when a new lookalike appears. dnstwist tells you which permutations exist today; DomainScan tells you which ones showed up yesterday and what to do about them.
All questions
What is dnstwist and what does DomainScan add on top?
Read the full guide
What Is Typosquatting? (And How Zscaler Found 30,000 Lookalikes)
Typosquatting turns a spelling mistake into an attack surface. Zscaler ThreatLabz recorded 30,000+ lookalike domains targeting the top brands in a single 6-month window — roughly 200 per brand. Homoglyph, TLD-swap, brand-suffix, punycode. Every family explained, with the MyEtherWallet punycode incident as the canonical case.