Hey @nix2intel can you say a bit more about the package and its uses here in your post?

Yeah for sure, it is a great way to find potential phishing attacks, typo squatting, and brand impersonation for your company domains. I updated above thank you.

Maybe I’m getting old, but these questions present themselves:

• what is typosquatting?
• what is typically done with all those domain name permutations? What’s the purpose?
• what is “concurrent domain analysis”?
• what does it mean to validate an MX record in this context?
• how does generating domain permutations help with finding phishing attacks?

I’m genuinely curious.

Actually a great question and I apologize for all the jargon, I forget sometimes i’m in a cybersecurity bubble

First, let’s talk about typosquatting. This is when attackers deliberately register misspelled versions of legitimate domain names. For example, they might register “Gooogle[.]com” hoping to catch people who accidentally type an extra ‘o’ when trying to reach Google.com It’s actually a form of cybersquatting, which means registering domains that infringe on someone else’s brand or copyright. These typosquatting techniques are often used in phishing attacks - that’s when criminals try to trick people into revealing sensitive information by pretending to be a trustworthy entity. They might send emails that appear to come from these slightly misspelled domains, hoping recipients won’t notice the subtle difference. An even more targeted version of this is used in Business Email Compromise (BEC) attacks. In a BEC attack, criminals specifically impersonate executives or business partners to trick employees into taking actions like making wire transfers or sharing sensitive information. They might register domains like “companynamefinance[.]com” that look legitimate at first glance. The tool I wrote helps defend against these threats by:

• Generating possible misspellings of legitimate domains which the NIF does
• Checking if these domains are registered (our elixir implementation)
• Looking for signs they might be used maliciously, like mail server setups, this is generally used by threat intelligence analysts or anyone taking a fine toothed comb through their environment. As of right now it is just grabbing the mx records for the domain variations, but could be expanded to do more in the future, but if I use microsoft servers and gmail, godaddy, or a selfhosted mail server shows up, that can be a huge red flag.

I made it run these checks concurrently because there can be hundreds or thousands of possible variations to check. The faster we can identify potentially malicious domains, the better chance we have of preventing successful attacks. What makes this particularly useful is that it helps catch these threats before they’re used in attacks. Think of it like a radar system for suspicious domains - it helps security teams spot potential threats before they become actual problems.

Thanks for clarifying! Interesting.

I feel using a NIF for this is overkill, as ultimately the bottleneck will be always the requests you send to those permutated domains.

What’s the significance of a NIF (Rust) here? Why is it needed?

I don’t disagree and at some point I may come back and write the permutation engine in elixir. I mention the NIF because I want folks to know what they are signing up for, as it is my understanding NIFS can bring down the beam correct? I am very new to elixir and this was more about getting things done for work (we were using dnstwist at work written in python hosted on an api) twistrs was already written for the permutations and it felt like a quick win and a way to solve a problem and add a nice library (work is great about letting us open source libraries but not main functionality. I have been doing a lot of dev work since moving from security architecture to threat intelligence and I used elixir to rewrite a tool at work that parses through sec filings looking for data breaches, the first iteration was terrible and would fail whenever a websocket connection failed, I was researching to try and fix it and discovered elixir. Has been a game changer at work and this will go a long way to updating our stack. Having said that could you look at my task implementation on the elixir side and make suggestions for speed ups? As you said requests are going to be the most time consuming piece, I’m considering flame on kubernetes cluster but may be overkill? I’ve been using elixir for less than a year and still very much learning.

There was already a great permutation engine in rust, I wanted to learn about NIFs and will be able to replace a key component at work written in python with an elixir library mostly.

Thank you! Being new to elixir i’d love feedback on the code and how i’m being dumb! I did Java way back in the day and mostly have done bash and python in the security space, but right now i’m loving elixir more and more each day.