Stop Domain-Based Threats Before They Impact Your Network
As IT and security professionals know, typosquatting, phishing, domain impersonation, and fraud domains are now part of everyday threat models.
DNS Twister gives you the visibility and automated threat detection you need to stay ahead of attackers targeting your domain infrastructure.
Why DNS Twister Matters for IT Security:
Proactive Domain Threat Intelligence
Adversaries increasingly register lookalike or homoglyph domains to exploit user typos or conduct phishing campaigns. DNS Twister identifies these threats before they surface in your logs or inboxes.
Real-Time Monitoring and Alerts
Most teams configure DNS once — and never revisit it. DNS Twister continuously monitors registered TLD space and SSL certificate issuances to detect newly registered or updated lookalike domains relevant to your footprint.
Support for Security Workflows & Automation
Receive real-time alerts via email, webhook, RSS, or API to tie into your existing detection pipelines, automation playbooks, or incident response tooling.
How It Works
Domain Fuzzing & Permutation
Using industry-standard DNS fuzzing algorithms (similar to the open-source dnstwist engine), we generate thousands of domain permutations for each input domain. These include homoglyphs, typos, transpositions, and more — the forms attackers use in real campaigns.
Registration & DNS Checks
Each permutation is checked against IPv4/IPv6, MX, and other critical DNS records to determine if it’s active and potentially being weaponized.
Certificate & Real-Time Monitoring
We scan SSL certificate issuance feeds and public registration data to detect new lookalike domains as soon as they go live — often before attackers deploy phishing infrastructure.
Alerts & Integration
Choose from configurable email, API/webhook, or RSS alerts. Integrate with SIEM/SOAR platforms or automated ticketing workflows for immediate action.
Key Features for Security Teams
Domain Threat Discovery
Generate and assess all plausible typo/homoglyph domains for threats and unauthorized registrations.
Continuous DNS & SSL Monitoring
Stay ahead of risks by watching your domain variants with real-time updates.
Alerts and API Access
Webhook/API delivery of threat detections into your SOC stack or automation tooling.
Multi-Domain Visibility
Manage alerts for a handful of core domains or an enterprise portfolio without exploding operational overhead.
Reporting and Intelligence
Export reports and feeds to drive downstream analysis or compliance documentation.
Included in your subscription
Reporting
Receive regular reports of newly registered similar domains or DNS changes that could indicate malicious activity.
Detailed Monitoring
We track critical A, MX, and other DNS indicators, giving you a complete picture of what’s happening with suspicious domains.
Multi Domain Pricing
Use our search tool for free, or setup ongoing monitoring for one domain or hundreds with our simple low cost plans.
Instant Alerts
Get immediate email or API notifications on critical changes for high-risk domains for instant threat prevention.
Developer API
Connect our monitoring tools to your systems for downstream response.
Customizable Notifications
Filter out noisy or trusted domains to key in on events that require response.
Choose your plan
Single Domain Plans
Alerts within 24 hours of a new A or MX record being registered for a domain similar to yours (example single-domain alert).
RSS feeds and a subscriber-only JSON API exposing current alerts and all resolved domains across your portfolio.
30 days of domain alert history, optional update and deletion alerts and country-level domain geolocation.
PERFECT FOR MANAGING A SMALL PORTFOLIO OF DOMAINS
Multiple Domain Plans
Everything in single-domain plans, except RSS feeds, for a significantly reduced price.
Alerts aggregated in a once-daily email.
Single invoice covers all monitored domains on a plan.
Add to or edit domains at any time, including through our new management API.
SIMPLIFIED ALERTING AND BILLING FOR LARGER PORTFOLIOS OF DOMAINS.
Trusted in Security Workflows
DNS Twister is used by cybersecurity teams, internal IT security groups, and infrastructure operations teams to detect threat domains and enforce digital brand security across global DNS and certificate spaces.
We are monitoring thousands of domains. Including these:
