nix2intel

DomainTwistex - Domain name permutation engine in Elixir using Rust NIFs

DomainTwistEx

This library helps organizations protect themselves against several types of domain-based cyber attacks. It specifically looks for:

Typosquatting: When attackers register misspelled versions of legitimate domains (like “gooogle[.]com” instead of “google.com”)
Phishing Infrastructure: Domains set up to impersonate trusted organizations in email-based attacks
Brand Impersonation: Domains created to look like legitimate company websites

How It Works

The library combines Elixir’s powerful ecosystem with Rust’s performance through Rustler NIFs. This makes it particularly effective for scanning and analyzing large numbers of potential threat domains quickly and efficiently.

Features

Domain Variation Generator: Creates possible misspellings that attackers might use, including:
- Missing characters (microsft[.]com)
- Replaced characters (rnicrosoft[.]com)
- Extra characters (micrrosoft[.]com)
- Swapped characters (micrsooft[.]com)
- Common typing mistakes
- Look-alike characters (using similar-looking letters)
Email Server Detection: Checks if suspicious domains are set up to receive email
Fast, Concurrent Analysis: Examines many domains simultaneously for quick results

Contributing

We welcome contributions! You can:

Report bugs
Suggest new features
Submit code changes
Help improve documentation

License

BSD-3-Clause

Links

https://github.com/osintowl/domaintwistex

16 comments

#library #nif #cybersecurity #osint

5 525 16

2025-01-18 00:23:26 UTC

Most Liked

benwilson512

Author of Craft GraphQL APIs in Elixir with Absinthe

Hey @nix2intel can you say a bit more about the package and its uses here in your post?

Post #2

D4no0

I feel using a NIF for this is overkill, as ultimately the bottleneck will be always the requests you send to those permutated domains.

Post #7

dimitarvp

What’s the significance of a NIF (Rust) here? Why is it needed?

Post #8

Last Post!

nix2intel

For anyone interested i made some recent changes, and will be implementing what @filmor just suggested in the coming days, but as an example, I ran this tool against forum.elixirforum.com 's domain and it found this:

  %{
    nameservers: ["ns2.ownidentity.com", "ns1.ownidentity.com"],
    kind: "Tld",
    fqdn: "elixirforum.it",
    ip_addresses: ["217.70.146.10"],
    mx_records: [%{priority: 10, server: "gmail-smtp-in.l.google.com"}],
    resolvable: true,
    server_response: %{
      server: "Microsoft-IIS/10.0",
      headers: %{
        "Accept-Ranges" => "bytes",
        "Connection" => "close",
        "Content-Length" => "444",
        "Content-Type" => "text/html",
        "Date" => "Sat, 18 Jan 2025 00:14:52 GMT",
        "ETag" => "\"0c4edd728bd71:0\"",
        "Last-Modified" => "Thu, 25 Feb 2021 03:46:48 GMT",
        "Server" => "Microsoft-IIS/10.0",
        "X-Powered-By" => "ASP.NET"
      },
      status_code: "200"
    },
    txt_records: [],
    tld: "it"
  },

is it malicious? probably not, but it is something I would potential check mail logs on for elixirforum, the domain is hosting an unconfigured plesk server that may be on a windows machine (always skeptical as I sometimes spoof headers as well) that is configured to use gmail as it’s mail servers. In our environment we’d likely add rules to either block the domain outright to avoid potential business email compromise accounts, or make rules in our organizational email for it. We would also monitor for changes to things like this.

Post #17