A dnstwist alternative for continuous monitoring

dnstwist is one of the best open-source security tools ever written, and if you need a one-off typosquatting audit, you should probably just use it. The problem it cannot solve by design is time: a CLI scan is a snapshot, and brand impersonation attacks unfold over weeks. VigilDNS takes the same permutation-and-inspect workflow and runs it for you on a schedule, every 24 or 12 hours depending on plan, with screenshots, AI verdicts, certificate history, and email alerts.

What dnstwist does, and does well

dnstwist is a free, Apache 2.0 licensed command-line tool by Marcin Ulikowski (elceef). You give it a domain, it generates lookalike permutations using a range of fuzzing algorithms (homoglyphs, hyphenation, dictionary words, and more, with Unicode and IDN support), then resolves them with multithreaded DNS lookups. It can geolocate resolved IPs, flag rogue MX hosts that could intercept misdirected email, and even compare pages against your real site using fuzzy hashing (ssdeep or TLSH) and perceptual hashing of screenshots if you have Chromium installed locally. Output comes as CSV, JSON, or a plain list, which makes it a pleasure to script. There is also a hosted one-shot version at dnstwist.it.

For a pentest report, an incident-response triage, or a quick "how bad is it" check, that is exactly the right tool. We recommend it without reservation for those jobs.

The gap: a snapshot of an attack that unfolds over time

A typical impersonation campaign does not exist at scan time. The attacker registers a domain that resolves to nothing, lets it age, obtains a TLS certificate, stands up a cloned login page for a few days, harvests credentials, and tears it down. Run dnstwist on Monday and the domain is parked; the phishing page goes live on Thursday. dnstwist has no scheduler, no state between runs, no change history, and no alerting. You can build all of that yourself with cron, a database, a diffing layer, and a notification pipeline, and plenty of teams have. That project is what VigilDNS replaces. If you want background on the threat itself, see what is typosquatting and homoglyph attacks.

What VigilDNS adds on top of the dnstwist workflow

VigilDNS starts from the same idea, a permutation engine with 13 techniques including homoglyphs, character swaps, omissions, repetitions, insertions, bitsquatting, and TLD swaps, then makes it continuous and hosted:

• Scheduled rescans every 24 or 12 hours depending on plan, with full DNS records (A, AAAA, MX, NS, CNAME, SPF, DMARC, DKIM, TXT) and a change history for every domain.
• Certificate history and live TLS for every lookalike, so you can see when a certificate appeared and who it names. A fresh certificate raises the risk score. Background in our guide to Certificate Transparency monitoring.
• Page screenshots with side-by-side clone detection, captured automatically rather than via a locally configured browser. Each visible change to a lookalike's page is kept, dated, and hashed.
• AI threat verdicts that judge intent (phishing, malware, counterfeit, parking, redirect, legitimate) with a confidence level and a written rationale, plus 0-100 risk scoring.
• Campaign detection that clusters domains run by the same actor via shared certificates, tracking IDs, and redirect targets.
• Dormant threat detection for domains that are registered but serve no DNS, verified against the registry.
• Takedown-ready drafts: abuse emails grouped by the address that handles each lookalike, with an evidence PDF attached, ready for you to send from your own mail.
• Email alerts when a scan finds newly registered lookalikes, in-app alerts when an AI verdict flags phishing, malware, or a counterfeit store, tenants with member roles, flags for lookalikes with a working mail server, ASN and geo attribution, RDAP registration data, CSV and JSON exports, and PDF reports.

To be clear about what VigilDNS does not do: it never sends or files a takedown for you (it prepares the drafts and evidence, and you send them), and it does not monitor marketplaces, social media, the dark web, or app stores. If you need those, look at the larger digital risk suites we compare in our ZeroFox comparison and our Bolster comparison.

dnstwist vs VigilDNS at a glance

dnstwist details were checked against its public README on 2026-09-28.

Keep using dnstwist if

Honestly, dnstwist remains the better fit in several cases:

• You are a pentester or red teamer producing point-in-time findings for a client report.
• You need a one-off audit, not ongoing coverage. A single scan answers a single question well.
• You want to script and automate inside your own pipeline. JSON output and an Apache 2.0 license are hard to beat.
• Your budget is zero. dnstwist plus cron plus your own diffing gets you a long way for free, and we would rather you have that than nothing.

Pricing

VigilDNS is self-serve with published pricing: Starter at $79/mo (5 domains, 3 seats, 24h scans), Team at $199/mo (20 domains, 10 seats, 12h), Business at $899/mo (100 domains, 25 seats, 12h), and a quote-only Enterprise tier for larger portfolios. Annual billing gives you 2 months free. Full details on the pricing page.

Frequently asked questions

Is dnstwist free?

Yes. dnstwist is open source under the Apache 2.0 license and installs via pip, Linux package managers, Homebrew, or Docker. There is also a free hosted one-shot scanner at dnstwist.it.

Can I run dnstwist continuously?

Not out of the box. dnstwist performs one-shot scans, so continuous coverage means building your own scheduler, state storage, diffing, and alerting around it. VigilDNS provides that as a hosted service with rescans every 24 or 12 hours by plan and an email alert whenever a scan finds newly registered lookalikes.

Does dnstwist take screenshots?

It can compare pages using fuzzy hashing and perceptual hashing of screenshots, but you must have Chromium installed locally and it only applies to that single scan. VigilDNS captures screenshots of suspicious lookalikes automatically, with no browser setup, shows side-by-side clone detection, and keeps each visible change dated and hashed.

Is there an online version of dnstwist?

Yes, dnstwist.it offers one-shot scans in the browser. For an online tool that keeps watching after the first scan, VigilDNS offers a free typosquat check and continuous monitoring on paid plans.

Run a free typosquat checker scan on your domain right now, no signup needed, and if the results worry you, see pricing to put it under continuous watch.