search

elceef / dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation
https://dnstwist.it
Apache License 2.0
4.76k stars 761 forks source link

Seems to get confused with wildcard domains? #163

Closed andrewfenn closed 1 year ago

andrewfenn commented 1 year ago

When typing in our company domain (vaultdragon.com) on the dnstwist.it site I have noticed variations such as vaultd.ragon.com, vaultdr.agon.com and so on.

These seem to not actually be set subdomains, but actually wildcard domains. I think it gives the wrong impression that these were actively set subdomains for malicious intent as opposed to wildcards that would respond regardless of the subdomain entered.

Is this a concern? It seems like it would be beneficial to have some denotation that certain subdomains being returned are due to a wildcard DNS settings so it's more obvious that it might not be anything too concerning?

elceef commented 1 year ago

I personally describe this as "collision" of brands/domains, when permutation of a legitimate domain turns into another very similar and also legitimate brand. In this particular case it's due to the wildcard domain. In general, all domains reported by the tool should be initially considered only as suspicious or potentially phishing.