category: Data Enrichment & Threat Intelligence
provider: Open Source
commonfields:
  id: dnstwist
  version: -1
description: Use the DNSTwist integration to detect typosquatting, phishing, and corporate espionage.
configuration: []
display: dnstwist
name: dnstwist
script:
  commands:
  - arguments:
    - description: The domain name for which to check for variations.
      name: domain
      required: true
    - default: true
      defaultValue: '30'
      description: Maximum number results to return in the context. This helps manage browser performance. The Markdown entry will display all results.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'no'
      description: Whether to perform a query for the Whois creation or last updated time (slow).
      name: whois
      predefined:
      - 'yes'
      - 'no'
    description: Checks for variations of a phishing domain name.
    name: dnstwist-domain-variations
    outputs:
    - contextPath: dnstwist.Domain.Domains.Name
      description: Domain name variations.
      type: String
    - contextPath: dnstwist.Domain.Domains.IP
      description: IP addresses that resolved to domain name variations.
      type: string
    - contextPath: dnstwist.Domain.Domains.DNS-MX
      description: Mail exchange records that resolved to domain name variations.
      type: string
    - contextPath: dnstwist.Domain.Domains.DNS-NS
      description: Server names that resolved to domain name variations.
      type: string
    - contextPath: dnstwist.Domain.Domains.WhoisUpdated
      description: Whois updated for domain name variations.
      type: string
    - contextPath: dnstwist.Domain.Domains.WhoisCreated
      description: Whois created for domain name variations.
      type: string
  dockerimage: demisto/dnstwist:1.0.0.10158186
  runonce: false
  script: '-'
  type: python
  subtype: python3
tests:
- No tests
fromversion: 5.0.0