OpenSquat : Detection Of Phishing Domains And Domain Squatting.

OpenSquat is an opensource Intelligence (OSINT) security tool to identify cyber squatting threats to specific companies or domains, such as:

• Phishing campaigns
• Domain squatting
• Typo squatting
• Bit squatting
• IDN homograph attacks
• Doppen ganger domains
• Other brand/domain related scams

It does support some key features such as:

• Automatic newly registered domain updating (once a day)
• Levenshtein distance to calculate word similarity
• Fetches active and known phishing domains (Phishing Database project)
• IDN homograph attack detection
• Integration with VirusTotal
• Integration with Quad9 DNS service
• Use different levels of confidence threshold to fine tune
• Save output into different formats (txt, JSON and CSV)
• Can be integrated with other threat intelligence tools and DNS sinkholes

How to Install

git clone https://github.com/atenreiro/opensquat
pip install -r requirements.txt

The “pip install” is just to make sure no new libs were added with the new upgrade.

Usage Examples

Edit the “keywords.txt” with your customised keywords to hunt.

#Lazy run with default options
python opensquat.py
#for all the options
python opensquat.py -h
#Search for generic terms used in phishing campaigns (can lead to false positives)
python opensquat.py -k generic.txt
#With DNS validation (quad9)
python opensquat.py –dns
#Subdomain search
python opensquat.py –subdomains
#Check for domains with open ports 80/443
python opensquat.py –portcheck
#With Phishing validation (Phishing Database)
python opensquat.py –phishing phish_results.txt
#Save output as JSON
python opensquat.py -o example.json -t json
#Save output as CSV
python opensquat.py -o example.csv -t csv
#Conduct a certificate transparency (ct) hunt
python opensquat.py –ct
#Period search – registrations from the last month (default: day)
python opensquat.py -p month
#Tweak confidence level. The lower values bring more false positives
#(0: very high, 1: high (default), 2: medium, 3: low, 4: very low
python opensquat.py -c 2
#All validations options
python opensquat.py –phishing phishing_domains.txt –dns –ct –subdomains –portcheck