python package - process explanations

elceef / dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

https://dnstwist.it

Apache License 2.0

4.73k stars 753 forks source link

python package - process explanations #173

Closed talelbaz closed 11 months ago

talelbaz commented 1 year ago

Hi, Can you please explain the process of the dnstwist in the python package (Who are the requests sent to? from where its get all the details and etc.. ) And another question, if I don't use the ssdeep arg, did it make a request to the suspicious domain site? I tried to go through the code, but I got a little confused, I would appreciate your help. Thanks!

elceef commented 1 year ago

dnstwist is an active scanner - it resolves many domain name candidates using configured DNS resolvers. If additional features like ssdeep or phash are enabled, the tool will also make direct HTTP requests to the servers behind resolved domain permutations in order to fetch the content.