search

elceef / dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
https://dnstwist.it
Apache License 2.0
4.76k stars 761 forks source link

Missing TLD detections for ".us.com" #144

Closed n2x4 closed 2 years ago

n2x4 commented 2 years ago

Recently came across domain spoofs where the TLD was ".us.com" it does not appear that this TLD is picked up by dnstwist as I've been unable to get a working detection.

elceef commented 2 years ago

The package contains dictionary files with common and most abused TLD, and ".us.com" is not present in both of them. The simplest solution is to compose your own dictionary file.

n2x4 commented 2 years ago

I've attempted to use the dictionary file argument as well as the tld argument and haven't been able to get this to show up. Hopefully you can point out what I'm missing.

  1. I added us.com to the common_tlds.dict file (you can see the grep in my screenshot showing it exists
  2. I ran dnstwist and referenced that dict file. I'm expecting to see output of all variations, and think I should see github.us.com in the results
  3. I grep the output of dnstwist for anything with us.com. There's no reference to github.us.com which I would expect to see.

Thank you for your help!

2022-02-16 14_44_02-zinger

n2x4 commented 2 years ago

I was able to get TLDs working with a pull of the latest code. I was not able to get the dictionary working, but perhaps I'm not understanding their function.