[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADTDCEBCS6RFNCZVG89G9R":3,"skill-same:01M6ADTDCEBCS6RFNCZVG89G9R":154},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":95,"commitSha":96,"skillDirectory":97,"forksCount":98,"repositoryHtmlUrl":99,"repositoryHomepageUrl":100,"ownerHtmlUrl":101,"ownerBlogUrl":102,"ownerDescription":103,"updatedAt":104,"install":105,"resources":118},"01M6ADTDCEBCS6RFNCZVG89G9R","analyzing-typosquatting-domains-with-dnstwist",null,"Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-typosquatting-domains-with-dnstwist\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"analyzing typosquatting domains with dnstwist","analyzing","threat-intelligence","homograph","brand-protection","typosquatting","dnstwist","dns","domain-monitoring","phishing","cybersecurity","monitoring","website","search","generate","create","development","monitor","infrastructure","2026-11-10 10:12:30",false,"---\nname: analyzing-typosquatting-domains-with-dnstwist\ndescription: Generate domain permutations with dnstwist and check DNS resolution\n  to detect typosquatting, homograph phishing, and brand impersonation domains registered\n  against your organization. Use when asked to monitor for lookalike domains, investigate\n  a phishing domain, or assess brand-impersonation risk.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- dnstwist\n- typosquatting\n- phishing\n- domain-monitoring\n- brand-protection\n- homograph\n- dns\n- threat-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0073\n- AML.T0052\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1583.001\n- T1566.002\n- T1598.003\n- T1583.006\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - resource-development\n  - reconnaissance\n  - initial-access\n  techniques:\n  - id: T1583.001\n    name: 'Acquire Infrastructure: Domains'\n    tactic: resource-development\n    source: attack\n  - id: F1020.002\n    name: 'Create Fake Materials: Fake Website'\n    tactic: resource-development\n    source: f3\n  - id: T1598\n    name: Phishing for Information\n    tactic: reconnaissance\n    source: attack\n  - id: T1593\n    name: Search Open Websites\u002FDomains\n    tactic: reconnaissance\n    source: attack\n  - id: T1660\n    name: Phishing\n    tactic: initial-access\n    source: attack\n---\n# Analyzing Typosquatting Domains with DNSTwist\n\n## Overview\n\nDNSTwist is a domain name permutation engine that generates similar-looking domain names to detect typosquatting, homograph phishing attacks, and brand impersonation. It creates thousands of domain permutations using techniques like character substitution, transposition, insertion, omission, and homoglyph replacement, then checks DNS records (A, AAAA, NS, MX), calculates web page similarity using fuzzy hashing (ssdeep) and perceptual hashing (pHash), and identifies potentially malicious registered domains.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing typosquatting domains with dnstwist\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dnstwist` installed (`pip install dnstwist[full]`)\n- Optional: GeoIP database for IP geolocation\n- Optional: Shodan API key for enrichment\n- Network access to perform DNS queries\n- Understanding of DNS record types and domain registration\n\n## Key Concepts\n\n### Domain Permutation Techniques\n\nDNSTwist generates permutations using: addition (appending characters), bitsquatting (bit-flip errors), homoglyph (visually similar Unicode characters like rn vs m), hyphenation (adding hyphens), insertion (inserting characters), omission (removing characters), repetition (repeating characters), replacement (replacing with adjacent keyboard keys), subdomain (inserting dots), transposition (swapping adjacent characters), vowel-swap (swapping vowels), and dictionary-based (appending common words).\n\n### Fuzzy Hashing and Visual Similarity\n\nDNSTwist uses ssdeep (locality-sensitive hash) to compare HTML content and pHash (perceptual hash) to compare screenshots of web pages. This helps identify cloned phishing sites that visually mimic the legitimate site. A high similarity score indicates a likely phishing page.\n\n### Detection Workflow\n\nThe typical workflow is: generate domain permutations -> resolve DNS records -> check for registered domains -> compare web page similarity -> flag suspicious domains -> alert security team -> request takedown. For a typical corporate domain, dnstwist generates 5,000-10,000 permutations.\n\n## Workflow\n\n### Step 1: Basic Domain Permutation Scan\n\n```python\nimport subprocess\nimport json\nimport csv\nfrom datetime import datetime\n\ndef run_dnstwist_scan(domain, output_file=None):\n    \"\"\"Run dnstwist scan against a target domain.\"\"\"\n    cmd = [\n        \"dnstwist\",\n        \"--registered\",     # Only show registered domains\n        \"--format\", \"json\", # Output in JSON\n        \"--nameservers\", \"8.8.8.8,1.1.1.1\",\n        \"--threads\", \"50\",\n        \"--mxcheck\",        # Check MX records\n        \"--ssdeep\",         # Fuzzy hash comparison\n        \"--geoip\",          # GeoIP lookup\n        domain,\n    ]\n\n    print(f\"[*] Scanning permutations for: {domain}\")\n    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)\n\n    if result.returncode == 0:\n        results = json.loads(result.stdout)\n        registered = [r for r in results if r.get(\"dns_a\") or r.get(\"dns_aaaa\")]\n        print(f\"[+] Found {len(registered)} registered lookalike domains\")\n\n        if output_file:\n            with open(output_file, \"w\") as f:\n                json.dump(registered, f, indent=2)\n            print(f\"[+] Results saved to {output_file}\")\n\n        return registered\n    else:\n        print(f\"[-] dnstwist error: {result.stderr}\")\n        return []\n\nresults = run_dnstwist_scan(\"example.com\", \"typosquat_results.json\")\n```\n\n### Step 2: Analyze and Prioritize Results\n\n```python\ndef analyze_results(results, legitimate_ips=None):\n    \"\"\"Analyze dnstwist results and prioritize threats.\"\"\"\n    legitimate_ips = legitimate_ips or set()\n    high_risk = []\n    medium_risk = []\n    low_risk = []\n\n    for entry in results:\n        domain = entry.get(\"domain\", \"\")\n        fuzzer = entry.get(\"fuzzer\", \"\")\n        dns_a = entry.get(\"dns_a\", [])\n        dns_mx = entry.get(\"dns_mx\", [])\n        ssdeep_score = entry.get(\"ssdeep_score\", 0)\n\n        risk_score = 0\n        risk_factors = []\n\n        # High similarity to legitimate site\n        if ssdeep_score and ssdeep_score > 50:\n            risk_score += 40\n            risk_factors.append(f\"high web similarity ({ssdeep_score}%)\")\n\n        # Has MX records (can receive email \u002F phishing)\n        if dns_mx:\n            risk_score += 20\n            risk_factors.append(\"has MX records (email capable)\")\n\n        # Recently registered (if whois data available)\n        whois_created = entry.get(\"whois_created\", \"\")\n        if whois_created:\n            try:\n                created = datetime.fromisoformat(whois_created.replace(\"Z\", \"+00:00\"))\n                age_days = (datetime.now(created.tzinfo) - created).days\n                if age_days \u003C 30:\n                    risk_score += 30\n                    risk_factors.append(f\"recently registered ({age_days} days)\")\n                elif age_days \u003C 90:\n                    risk_score += 15\n                    risk_factors.append(f\"registered {age_days} days ago\")\n            except (ValueError, TypeError):\n                pass\n\n        # Homoglyph attacks are highest risk\n        if fuzzer == \"homoglyph\":\n            risk_score += 25\n            risk_factors.append(\"homoglyph (visually identical)\")\n        elif fuzzer in (\"addition\", \"replacement\", \"transposition\"):\n            risk_score += 10\n            risk_factors.append(f\"permutation type: {fuzzer}\")\n\n        # Not pointing to legitimate infrastructure\n        if dns_a and not set(dns_a).intersection(legitimate_ips):\n            risk_score += 10\n            risk_factors.append(\"different IP from legitimate\")\n\n        entry[\"risk_score\"] = risk_score\n        entry[\"risk_factors\"] = risk_factors\n\n        if risk_score >= 50:\n            high_risk.append(entry)\n        elif risk_score >= 25:\n            medium_risk.append(entry)\n        else:\n            low_risk.append(entry)\n\n    high_risk.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n    medium_risk.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n\n    print(f\"\\n=== Typosquatting Analysis ===\")\n    print(f\"High Risk: {len(high_risk)}\")\n    print(f\"Medium Risk: {len(medium_risk)}\")\n    print(f\"Low Risk: {len(low_risk)}\")\n\n    if high_risk:\n        print(f\"\\n--- High Risk Domains ---\")\n        for entry in high_risk[:10]:\n            print(f\"  {entry['domain']} (score: {entry['risk_score']})\")\n            for factor in entry['risk_factors']:\n                print(f\"    - {factor}\")\n\n    return {\"high\": high_risk, \"medium\": medium_risk, \"low\": low_risk}\n\nanalysis = analyze_results(results, legitimate_ips={\"93.184.216.34\"})\n```\n\n### Step 3: Continuous Monitoring Pipeline\n\n```python\nimport time\nimport hashlib\n\nclass TyposquatMonitor:\n    def __init__(self, domains, known_domains_file=\"known_typosquats.json\"):\n        self.domains = domains\n        self.known_file = known_domains_file\n        self.known_domains = self._load_known()\n\n    def _load_known(self):\n        try:\n            with open(self.known_file, \"r\") as f:\n                return json.load(f)\n        except FileNotFoundError:\n            return {}\n\n    def _save_known(self):\n        with open(self.known_file, \"w\") as f:\n            json.dump(self.known_domains, f, indent=2)\n\n    def scan_all_domains(self):\n        \"\"\"Scan all monitored domains for new typosquats.\"\"\"\n        new_findings = []\n        for domain in self.domains:\n            results = run_dnstwist_scan(domain)\n            for entry in results:\n                domain_key = entry.get(\"domain\", \"\")\n                if domain_key not in self.known_domains:\n                    entry[\"first_seen\"] = datetime.now().isoformat()\n                    entry[\"monitored_domain\"] = domain\n                    self.known_domains[domain_key] = entry\n                    new_findings.append(entry)\n                    print(f\"  [NEW] {domain_key} ({entry.get('fuzzer', '')})\")\n\n        self._save_known()\n        print(f\"\\n[+] New typosquatting domains found: {len(new_findings)}\")\n        return new_findings\n\n    def generate_alert(self, findings):\n        \"\"\"Generate alert for new high-risk typosquatting domains.\"\"\"\n        analysis = analyze_results(findings)\n        alerts = []\n        for entry in analysis[\"high\"]:\n            alerts.append({\n                \"severity\": \"HIGH\",\n                \"domain\": entry[\"domain\"],\n                \"target\": entry.get(\"monitored_domain\", \"\"),\n                \"risk_score\": entry[\"risk_score\"],\n                \"risk_factors\": entry[\"risk_factors\"],\n                \"dns_a\": entry.get(\"dns_a\", []),\n                \"dns_mx\": entry.get(\"dns_mx\", []),\n                \"timestamp\": datetime.now().isoformat(),\n            })\n        return alerts\n\nmonitor = TyposquatMonitor([\"mycompany.com\", \"mycompany.org\"])\nnew_findings = monitor.scan_all_domains()\nalerts = monitor.generate_alert(new_findings)\n```\n\n### Step 4: Export for Blocklist and Takedown\n\n```python\ndef export_blocklist(analysis, output_file=\"blocklist.txt\"):\n    \"\"\"Export high-risk domains as blocklist for firewall\u002Fproxy.\"\"\"\n    domains = []\n    for entry in analysis[\"high\"] + analysis[\"medium\"]:\n        domain = entry.get(\"domain\", \"\")\n        if domain:\n            domains.append(domain)\n\n    with open(output_file, \"w\") as f:\n        f.write(f\"# Typosquatting blocklist generated {datetime.now().isoformat()}\\n\")\n        for d in sorted(set(domains)):\n            f.write(f\"{d}\\n\")\n\n    print(f\"[+] Blocklist saved: {len(domains)} domains -> {output_file}\")\n    return domains\n\ndef generate_takedown_report(high_risk_domains):\n    \"\"\"Generate takedown request report.\"\"\"\n    report = f\"\"\"# Domain Takedown Request\nGenerated: {datetime.now().isoformat()}\n\n## Summary\n{len(high_risk_domains)} domains identified as potential typosquatting\u002Fphishing.\n\n## Domains Requiring Takedown\n\"\"\"\n    for entry in high_risk_domains:\n        report += f\"\"\"\n### {entry['domain']}\n- **Permutation Type**: {entry.get('fuzzer', 'unknown')}\n- **IP Address**: {', '.join(entry.get('dns_a', ['N\u002FA']))}\n- **MX Records**: {', '.join(entry.get('dns_mx', ['N\u002FA']))}\n- **Risk Score**: {entry.get('risk_score', 0)}\n- **Risk Factors**: {'; '.join(entry.get('risk_factors', []))}\n- **Web Similarity**: {entry.get('ssdeep_score', 'N\u002FA')}%\n\"\"\"\n    with open(\"takedown_report.md\", \"w\") as f:\n        f.write(report)\n    print(\"[+] Takedown report generated: takedown_report.md\")\n\nexport_blocklist(analysis)\ngenerate_takedown_report(analysis[\"high\"])\n```\n\n## Validation Criteria\n\n- DNSTwist generates domain permutations for target domain\n- DNS resolution identifies registered lookalike domains\n- Web similarity scoring detects cloned phishing pages\n- Risk scoring prioritizes domains by threat level\n- Continuous monitoring detects newly registered typosquats\n- Blocklist and takedown reports generated correctly\n\n## References\n\n- [dnstwist GitHub Repository](https:\u002F\u002Fgithub.com\u002Felceef\u002Fdnstwist)\n- [dnstwister Online Service](https:\u002F\u002Fdnstwister.report\u002F)\n- [HawkEye: Detect Typosquatting with DNSTwist](https:\u002F\u002Fhawk-eye.io\u002F2022\u002F11\u002Fhow-to-detect-typosquatting-using-dnstwist\u002F)\n- [Darktrace: Monitoring Typosquatting Domains](https:\u002F\u002Fwww.darktrace.com\u002Fblog\u002Fvigilance-in-action-monitoring-typosquatting-domains)\n- [Security Risk Advisors: Domain Monitoring](https:\u002F\u002Fsra.io\u002Fblog\u002Fdomain-monitoring-fast-and-cheap\u002F)\n- [Conscia: How to Detect Typosquatting](https:\u002F\u002Fconscia.com\u002Fblog\u002Fdiving-deep-how-to-detect-typosquatting\u002F)\n","# Analyzing Typosquatting Domains with DNSTwist\n\n## Overview\n\nDNSTwist is a domain name permutation engine that generates similar-looking domain names to detect typosquatting, homograph phishing attacks, and brand impersonation. It creates thousands of domain permutations using techniques like character substitution, transposition, insertion, omission, and homoglyph replacement, then checks DNS records (A, AAAA, NS, MX), calculates web page similarity using fuzzy hashing (ssdeep) and perceptual hashing (pHash), and identifies potentially malicious registered domains.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing typosquatting domains with dnstwist\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `dnstwist` installed (`pip install dnstwist[full]`)\n- Optional: GeoIP database for IP geolocation\n- Optional: Shodan API key for enrichment\n- Network access to perform DNS queries\n- Understanding of DNS record types and domain registration\n\n## Key Concepts\n\n### Domain Permutation Techniques\n\nDNSTwist generates permutations using: addition (appending characters), bitsquatting (bit-flip errors), homoglyph (visually similar Unicode characters like rn vs m), hyphenation (adding hyphens), insertion (inserting characters), omission (removing characters), repetition (repeating characters), replacement (replacing with adjacent keyboard keys), subdomain (inserting dots), transposition (swapping adjacent characters), vowel-swap (swapping vowels), and dictionary-based (appending common words).\n\n### Fuzzy Hashing and Visual Similarity\n\nDNSTwist uses ssdeep (locality-sensitive hash) to compare HTML content and pHash (perceptual hash) to compare screenshots of web pages. This helps identify cloned phishing sites that visually mimic the legitimate site. A high similarity score indicates a likely phishing page.\n\n### Detection Workflow\n\nThe typical workflow is: generate domain permutations -> resolve DNS records -> check for registered domains -> compare web page similarity -> flag suspicious domains -> alert security team -> request takedown. For a typical corporate domain, dnstwist generates 5,000-10,000 permutations.\n\n## Workflow\n\n### Step 1: Basic Domain Permutation Scan\n\n```python\nimport subprocess\nimport json\nimport csv\nfrom datetime import datetime\n\ndef run_dnstwist_scan(domain, output_file=None):\n    \"\"\"Run dnstwist scan against a target domain.\"\"\"\n    cmd = [\n        \"dnstwist\",\n        \"--registered\",     # Only show registered domains\n        \"--format\", \"json\", # Output in JSON\n        \"--nameservers\", \"8.8.8.8,1.1.1.1\",\n        \"--threads\", \"50\",\n        \"--mxcheck\",        # Check MX records\n        \"--ssdeep\",         # Fuzzy hash comparison\n        \"--geoip\",          # GeoIP lookup\n        domain,\n    ]\n\n    print(f\"[*] Scanning permutations for: {domain}\")\n    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)\n\n    if result.returncode == 0:\n        results = json.loads(result.stdout)\n        registered = [r for r in results if r.get(\"dns_a\") or r.get(\"dns_aaaa\")]\n        print(f\"[+] Found {len(registered)} registered lookalike domains\")\n\n        if output_file:\n            with open(output_file, \"w\") as f:\n                json.dump(registered, f, indent=2)\n            print(f\"[+] Results saved to {output_file}\")\n\n        return registered\n    else:\n        print(f\"[-] dnstwist error: {result.stderr}\")\n        return []\n\nresults = run_dnstwist_scan(\"example.com\", \"typosquat_results.json\")\n```\n\n### Step 2: Analyze and Prioritize Results\n\n```python\ndef analyze_results(results, legitimate_ips=None):\n    \"\"\"Analyze dnstwist results and prioritize threats.\"\"\"\n    legitimate_ips = legitimate_ips or set()\n    high_risk = []\n    medium_risk = []\n    low_risk = []\n\n    for entry in results:\n        domain = entry.get(\"domain\", \"\")\n        fuzzer = entry.get(\"fuzzer\", \"\")\n        dns_a = entry.get(\"dns_a\", [])\n        dns_mx = entry.get(\"dns_mx\", [])\n        ssdeep_score = entry.get(\"ssdeep_score\", 0)\n\n        risk_score = 0\n        risk_factors = []\n\n        # High similarity to legitimate site\n        if ssdeep_score and ssdeep_score > 50:\n            risk_score += 40\n            risk_factors.append(f\"high web similarity ({ssdeep_score}%)\")\n\n        # Has MX records (can receive email \u002F phishing)\n        if dns_mx:\n            risk_score += 20\n            risk_factors.append(\"has MX records (email capable)\")\n\n        # Recently registered (if whois data available)\n        whois_created = entry.get(\"whois_created\", \"\")\n        if whois_created:\n            try:\n                created = datetime.fromisoformat(whois_created.replace(\"Z\", \"+00:00\"))\n                age_days = (datetime.now(created.tzinfo) - created).days\n                if age_days \u003C 30:\n                    risk_score += 30\n                    risk_factors.append(f\"recently registered ({age_days} days)\")\n                elif age_days \u003C 90:\n                    risk_score += 15\n                    risk_factors.append(f\"registered {age_days} days ago\")\n            except (ValueError, TypeError):\n                pass\n\n        # Homoglyph attacks are highest risk\n        if fuzzer == \"homoglyph\":\n            risk_score += 25\n            risk_factors.append(\"homoglyph (visually identical)\")\n        elif fuzzer in (\"addition\", \"replacement\", \"transposition\"):\n            risk_score += 10\n            risk_factors.append(f\"permutation type: {fuzzer}\")\n\n        # Not pointing to legitimate infrastructure\n        if dns_a and not set(dns_a).intersection(legitimate_ips):\n            risk_score += 10\n            risk_factors.append(\"different IP from legitimate\")\n\n        entry[\"risk_score\"] = risk_score\n        entry[\"risk_factors\"] = risk_factors\n\n        if risk_score >= 50:\n            high_risk.append(entry)\n        elif risk_score >= 25:\n            medium_risk.append(entry)\n        else:\n            low_risk.append(entry)\n\n    high_risk.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n    medium_risk.sort(key=lambda x: x[\"risk_score\"], reverse=True)\n\n    print(f\"\\n=== Typosquatting Analysis ===\")\n    print(f\"High Risk: {len(high_risk)}\")\n    print(f\"Medium Risk: {len(medium_risk)}\")\n    print(f\"Low Risk: {len(low_risk)}\")\n\n    if high_risk:\n        print(f\"\\n--- High Risk Domains ---\")\n        for entry in high_risk[:10]:\n            print(f\"  {entry['domain']} (score: {entry['risk_score']})\")\n            for factor in entry['risk_factors']:\n                print(f\"    - {factor}\")\n\n    return {\"high\": high_risk, \"medium\": medium_risk, \"low\": low_risk}\n\nanalysis = analyze_results(results, legitimate_ips={\"93.184.216.34\"})\n```\n\n### Step 3: Continuous Monitoring Pipeline\n\n```python\nimport time\nimport hashlib\n\nclass TyposquatMonitor:\n    def __init__(self, domains, known_domains_file=\"known_typosquats.json\"):\n        self.domains = domains\n        self.known_file = known_domains_file\n        self.known_domains = self._load_known()\n\n    def _load_known(self):\n        try:\n            with open(self.known_file, \"r\") as f:\n                return json.load(f)\n        except FileNotFoundError:\n            return {}\n\n    def _save_known(self):\n        with open(self.known_file, \"w\") as f:\n            json.dump(self.known_domains, f, indent=2)\n\n    def scan_all_domains(self):\n        \"\"\"Scan all monitored domains for new typosquats.\"\"\"\n        new_findings = []\n        for domain in self.domains:\n            results = run_dnstwist_scan(domain)\n            for entry in results:\n                domain_key = entry.get(\"domain\", \"\")\n                if domain_key not in self.known_domains:\n                    entry[\"first_seen\"] = datetime.now().isoformat()\n                    entry[\"monitored_domain\"] = domain\n                    self.known_domains[domain_key] = entry\n                    new_findings.append(entry)\n                    print(f\"  [NEW] {domain_key} ({entry.get('fuzzer', '')})\")\n\n        self._save_known()\n        print(f\"\\n[+] New typosquatting domains found: {len(new_findings)}\")\n        return new_findings\n\n    def generate_alert(self, findings):\n        \"\"\"Generate alert for new high-risk typosquatting domains.\"\"\"\n        analysis = analyze_results(findings)\n        alerts = []\n        for entry in analysis[\"high\"]:\n            alerts.append({\n                \"severity\": \"HIGH\",\n                \"domain\": entry[\"domain\"],\n                \"target\": entry.get(\"monitored_domain\", \"\"),\n                \"risk_score\": entry[\"risk_score\"],\n                \"risk_factors\": entry[\"risk_factors\"],\n                \"dns_a\": entry.get(\"dns_a\", []),\n                \"dns_mx\": entry.get(\"dns_mx\", []),\n                \"timestamp\": datetime.now().isoformat(),\n            })\n        return alerts\n\nmonitor = TyposquatMonitor([\"mycompany.com\", \"mycompany.org\"])\nnew_findings = monitor.scan_all_domains()\nalerts = monitor.generate_alert(new_findings)\n```\n\n### Step 4: Export for Blocklist and Takedown\n\n```python\ndef export_blocklist(analysis, output_file=\"blocklist.txt\"):\n    \"\"\"Export high-risk domains as blocklist for firewall\u002Fproxy.\"\"\"\n    domains = []\n    for entry in analysis[\"high\"] + analysis[\"medium\"]:\n        domain = entry.get(\"domain\", \"\")\n        if domain:\n            domains.append(domain)\n\n    with open(output_file, \"w\") as f:\n        f.write(f\"# Typosquatting blocklist generated {datetime.now().isoformat()}\\n\")\n        for d in sorted(set(domains)):\n            f.write(f\"{d}\\n\")\n\n    print(f\"[+] Blocklist saved: {len(domains)} domains -> {output_file}\")\n    return domains\n\ndef generate_takedown_report(high_risk_domains):\n    \"\"\"Generate takedown request report.\"\"\"\n    report = f\"\"\"# Domain Takedown Request\nGenerated: {datetime.now().isoformat()}\n\n## Summary\n{len(high_risk_domains)} domains identified as potential typosquatting\u002Fphishing.\n\n## Domains Requiring Takedown\n\"\"\"\n    for entry in high_risk_domains:\n        report += f\"\"\"\n### {entry['domain']}\n- **Permutation Type**: {entry.get('fuzzer', 'unknown')}\n- **IP Address**: {', '.join(entry.get('dns_a', ['N\u002FA']))}\n- **MX Records**: {', '.join(entry.get('dns_mx', ['N\u002FA']))}\n- **Risk Score**: {entry.get('risk_score', 0)}\n- **Risk Factors**: {'; '.join(entry.get('risk_factors', []))}\n- **Web Similarity**: {entry.get('ssdeep_score', 'N\u002FA')}%\n\"\"\"\n    with open(\"takedown_report.md\", \"w\") as f:\n        f.write(report)\n    print(\"[+] Takedown report generated: takedown_report.md\")\n\nexport_blocklist(analysis)\ngenerate_takedown_report(analysis[\"high\"])\n```\n\n## Validation Criteria\n\n- DNSTwist generates domain permutations for target domain\n- DNS resolution identifies registered lookalike domains\n- Web similarity scoring detects cloned phishing pages\n- Risk scoring prioritizes domains by threat level\n- Continuous monitoring detects newly registered typosquats\n- Blocklist and takedown reports generated correctly\n\n## References\n\n- [dnstwist GitHub Repository](https:\u002F\u002Fgithub.com\u002Felceef\u002Fdnstwist)\n- [dnstwister Online Service](https:\u002F\u002Fdnstwister.report\u002F)\n- [HawkEye: Detect Typosquatting with DNSTwist](https:\u002F\u002Fhawk-eye.io\u002F2022\u002F11\u002Fhow-to-detect-typosquatting-using-dnstwist\u002F)\n- [Darktrace: Monitoring Typosquatting Domains](https:\u002F\u002Fwww.darktrace.com\u002Fblog\u002Fvigilance-in-action-monitoring-typosquatting-domains)\n- [Security Risk Advisors: Domain Monitoring](https:\u002F\u002Fsra.io\u002Fblog\u002Fdomain-monitoring-fast-and-cheap\u002F)\n- [Conscia: How to Detect Typosquatting](https:\u002F\u002Fconscia.com\u002Fblog\u002Fdiving-deep-how-to-detect-typosquatting\u002F)\n",{"name":5,"tags":56,"author":57,"domain":42,"license":15,"version":58,"mitre_f3":59,"nist_csf":83,"subdomain":34,"description":7,"mitre_attack":88,"atlas_techniques":92},[38,37,41,40,36,35,39,34],"mahipal","1.0",{"tactics":60,"version":64,"techniques":65},[61,62,63],"resource-development","reconnaissance","initial-access","1.1",[66,70,74,77,80],{"id":67,"name":68,"source":69,"tactic":61},"T1583.001","Acquire Infrastructure: Domains","attack",{"id":71,"name":72,"source":73,"tactic":61},"F1020.002","Create Fake Materials: Fake Website","f3",{"id":75,"name":76,"source":69,"tactic":62},"T1598","Phishing for Information",{"id":78,"name":79,"source":69,"tactic":62},"T1593","Search Open Websites\u002FDomains",{"id":81,"name":82,"source":69,"tactic":63},"T1660","Phishing",[84,85,86,87],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[67,89,90,91],"T1566.002","T1598.003","T1583.006",[93,94],"AML.T0073","AML.T0052","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-typosquatting-domains-with-dnstwist",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":106,"prompt":116,"zipAvailable":117},[107,110,113],{"tool":108,"command":109},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-typosquatting-domains-with-dnstwist",{"tool":111,"command":112},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-typosquatting-domains-with-dnstwist",{"tool":114,"command":115},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-typosquatting-domains-with-dnstwist","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-typosquatting-domains-with-dnstwist\u002FSKILL.md",true,[119,124,130,136,140,144,150],{"path":120,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-typosquatting-domains-with-dnstwist\u002FLICENSE",{"path":125,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":128,"sourceHtmlUrl":129},"references\u002Fapi-reference.md","REFERENCE","参考文档",2155,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-typosquatting-domains-with-dnstwist\u002Freferences\u002Fapi-reference.md",{"path":131,"resourceType":132,"resourceTypeDesc":133,"sizeBytes":134,"sourceHtmlUrl":135},"scripts\u002Fagent.py","SCRIPT","脚本",3614,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-typosquatting-domains-with-dnstwist\u002Fscripts\u002Fagent.py",{"path":137,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":138,"sourceHtmlUrl":139},"sections\u002Fmanifest.json",574,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-design-review\u002Fsections\u002Fmanifest.json",{"path":141,"resourceType":126,"resourceTypeDesc":127,"sizeBytes":142,"sourceHtmlUrl":143},"sections\u002Freview-sections.md",38631,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-design-review\u002Fsections\u002Freview-sections.md",{"path":145,"resourceType":146,"resourceTypeDesc":147,"sizeBytes":148,"sourceHtmlUrl":149},"sections\u002Freview-sections.md.tmpl","OTHER","其他",13791,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-design-review\u002Fsections\u002Freview-sections.md.tmpl",{"path":151,"resourceType":146,"resourceTypeDesc":147,"sizeBytes":152,"sourceHtmlUrl":153},"SKILL.md.tmpl",16816,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-design-review\u002FSKILL.md.tmpl",[155,182,206,233,259,286],{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":51},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[161],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[163,164,165,166,167,42,168,169,170,171,172,173,174,175,176,177,178,179,180,181],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":51},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,178,191,192,167,193,42,170,194,195,196,197,198,199,200,201,202,203,204,205],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":216,"publishedAt":51},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[212,215],{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[200,217,218,219,220,42,50,221,194,222,223,224,225,226,227,228,229,230,231,232],"backup","recovery","validating backup integrity for recovery","testing","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":51},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[239],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[241,242,243,42,244,245,246,247,248,249,250,251,252,253,254,255,197,256,257,258],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":260,"name":261,"nameZh":6,"description":262,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":263,"categories":264,"keywords":266,"publishedAt":51},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[265],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[267,268,269,42,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":287,"name":288,"nameZh":6,"description":289,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":290,"categories":291,"keywords":293,"publishedAt":51},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[292],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[167,294,42,295,296,297,298,299,300,301,302,228,303,229,304,305,306,307,308,309],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]