Guide · Agent skill
How to use the Typosquatting Domain Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains what the analyzing-typosquatting-domains-with-dnstwist agent skill does, how to install it, and how to ask an agent to run it. It uses dnstwist, an open-source domain permutation tool, to find lookalike domains that could be used to impersonate your brand in phishing. By the end you will know the requirements, how to trigger the skill with plain requests, and the safety limits to keep in mind.
Typosquatting Domain Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the skill ZIP from this page and unzip it. Confirm that SKILL.md, scripts/agent.py and references/api-reference.md are present.
- 2Place the skill folder. Move the folder into ~/.claude/skills/ for a personal install or into .claude/skills/ in a project. Alternatively, upload it in the Claude apps under Settings, Capabilities, Skills.
- 3Install Python 3.9 or newer. Make sure Python 3.9+ is available in the environment the agent uses.
- 4Install dnstwist with the full extras. Run pip install dnstwist[full] to install the dnstwist Python package with its full extras.
- 5Make a natural request. Ask the agent to monitor for lookalike domains, investigate a suspicious domain or assess brand-impersonation risk, naming a domain you are authorised to check.
- 6Review the output. Check the flagged domains manually, looking at registration, mail records and page similarity, before escalating or requesting a takedown.
What the skill makes the agent do
Once installed, the agent can take a domain such as your company's domain and generate many similar-looking variations. These include misspellings, swapped letters, added or removed characters, and characters that look alike. It then checks which variations are registered and resolving on the internet, using DNS record lookups (A, AAAA, NS and MX records).
The skill's instructions also describe comparing how lookalike web pages look, using fuzzy hashing (ssdeep) on HTML and perceptual hashing (pHash) on screenshots. The source excerpt shows only part of that workflow, so do not assume every comparison step is included in the code you receive.
- Generates permutations with techniques such as addition, homoglyph, omission, transposition, vowel-swap and dictionary-based appends
- Checks DNS records to see which lookalike domains are registered
- Describes web page similarity checks for cloned phishing sites
- Helps prioritise results by risk, using factors such as MX records, web similarity and domain age
Install the skill from the ZIP file
Download the skill ZIP from this page and unzip it. Then place the skill folder in one of two locations. For a personal install available across your projects, put it in ~/.claude/skills/. For a project-only install, put it in the .claude/skills/ folder inside that project.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills. The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills
Install the dnstwist Python package
The skill needs Python 3.9 or newer and the dnstwist Python package. The source gives this install command with the full extras. Run it in the same Python environment the agent will use.
The source lists two optional extras: a GeoIP database for IP geolocation and a Shodan API key for enrichment. Neither is required to start.
- Python 3.9+ is required
- Network access is required for DNS queries
- GeoIP database: optional
- Shodan API key: optional
pip install dnstwist[full]How to trigger the skill with natural requests
You do not need to type a command. The skill's description says to use it when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk. Describe the task in plain language and name the domain you are authorised to check.
Good requests state the goal and the target. Give the domain and say whether you want a monitoring scan, an investigation of one suspicious domain, or a risk review.
- Check which lookalike domains are registered for example.com and list the ones with mail servers.
- Investigate whether paypa1-example.com is a phishing domain imitating our site.
- Monitor for typosquatting and homograph domains against our company domain and summarise the high-risk results.
- Assess brand-impersonation risk for our main domain and suggest what to report for takedown.
Run dnstwist directly from the command line
The skill's reference file lists dnstwist command-line options. These are useful for checking that the tool works before you ask the agent to run a full scan, and for understanding what the agent is doing.
The examples below come from the reference file. -r resolves DNS, -f sets the output format, --ssdeep adds fuzzy hashing comparison, and --phash adds a perceptual hash for screenshots. The custom DNS option lets you choose a nameserver.
- -r: resolve DNS records
- -f json or -f csv: choose output format
- --ssdeep: fuzzy hashing comparison
- --phash: perceptual hash (screenshot)
- -w wordlist.txt: dictionary-based permutations
- --nameservers 8.8.8.8: custom DNS server
dnstwist -r -f json example.comReview and act on the results
Treat the output as a list of candidates to investigate, not a verdict. DNS results only show that a domain is registered. They do not show intent. The source says the permutations are heuristic, so a complete or authoritative list is not guaranteed.
The skill's example scoring gives more weight to high web similarity, mail (MX) records, very recent registration and homoglyph permutations, and less weight to other permutation types. Check flagged domains manually before you alert the security team or request a takedown, and only act with authorisation.
- Confirm the domain is registered and check its records
- Compare the page with your legitimate site before escalating
- Note mail records, since they suggest the domain can receive email
- Record findings, then alert the security team and request takedown where authorised
What people use it for
- Monitoring your company's domain for misspelled or look-alike registrations that could be used in phishing
- Investigating a suspicious domain that an employee or customer reported
- Preparing a list of lookalike domains to review for a brand-protection or takedown request
- Building a lookalike-domain monitoring tool for an organisation, using the skill's scripts as a starting point
Frequently asked questions
How do I install the dnstwist typosquatting agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for a personal install or into .claude/skills/ in a project. You can also upload it in the Claude apps under Settings, Capabilities, Skills. You also need Python 3.9+ and the dnstwist package, installed with pip install dnstwist[full].
What are the requirements to run this skill?
The source lists Python 3.9+, the dnstwist Python package, network access for DNS queries, and two optional extras: a GeoIP database and a Shodan API key. The skill runs scripts and uses the network, so it is not suited to people without Python and command-line experience.
Is the typosquatting dnstwist skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. The source does not give pricing. The optional Shodan API key is a separate service that the source describes as optional enrichment, so check its terms if you use it.
Can I use this skill to attack or impersonate other organisations?
No. The source says the output is a list of lookalike domains that could be misused, so it should be used only for defensive monitoring and for takedown requests made with authorisation.
Does the skill prove a lookalike domain is a phishing site?
No. DNS results only show that a domain is registered, not what it is used for. The source describes the permutations as heuristic, so you should review each candidate manually before reaching a conclusion.
Can I run dnstwist without the agent?
Yes. The reference file documents dnstwist command-line options such as dnstwist -r -f json example.com. The source does not compare this skill with other tools, so you would need to research alternatives yourself.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security analysts, incident responders and developers who need a repeatable way to find lookalike domains for a brand and who are comfortable with Python and the command line. It is not a complete or authoritative list, and it should not be used to impersonate anyone. If you need a no-code tool or a guaranteed full inventory of impersonation domains, pick something else.
Download the skill