Kali Linux

OpenSquat : Detection Of Phishing Domains And Domain Squatting.

OpenSquat is an opensource Intelligence (OSINT) security tool to identify cyber squatting threats to specific companies or domains, such as:

Phishing campaigns
Domain squatting
Typo squatting
Bit squatting
IDN homograph attacks
Doppen ganger domains
Other brand/domain related scams

It does support some key features such as:

Automatic newly registered domain updating (once a day)
Levenshtein distance to calculate word similarity
Fetches active and known phishing domains (Phishing Database project)
IDN homograph attack detection
Integration with VirusTotal
Integration with Quad9 DNS service
Use different levels of confidence threshold to fine tune
Save output into different formats (txt, JSON and CSV)
Can be integrated with other threat intelligence tools and DNS sinkholes

How to Install

git clone https://github.com/atenreiro/opensquat
pip install -r requirements.txt

The “pip install” is just to make sure no new libs were added with the new upgrade.

Usage Examples

Edit the “keywords.txt” with your customised keywords to hunt.

#Lazy run with default options
python opensquat.py
#for all the options
python opensquat.py -h
#Search for generic terms used in phishing campaigns (can lead to false positives)
python opensquat.py -k generic.txt
#With DNS validation (quad9)
python opensquat.py –dns
#Subdomain search
python opensquat.py –subdomains
#Check for domains with open ports 80/443
python opensquat.py –portcheck
#With Phishing validation (Phishing Database)
python opensquat.py –phishing phish_results.txt
#Save output as JSON
python opensquat.py -o example.json -t json
#Save output as CSV
python opensquat.py -o example.csv -t csv
#Conduct a certificate transparency (ct) hunt
python opensquat.py –ct
#Period search – registrations from the last month (default: day)
python opensquat.py -p month
#Tweak confidence level. The lower values bring more false positives
#(0: very high, 1: high (default), 2: medium, 3: low, 4: very low
python opensquat.py -c 2
#All validations options
python opensquat.py –phishing phishing_domains.txt –dns –ct –subdomains –portcheck