Brand Proof HQ

Home · Guide · Brand Abuse Desk

DNSTwist Is Not Enough: Finding Phishing Clones With Unrelated Domains

Security teams often start brand monitoring with typosquat generators: DNSTwist, openSquat, permutation lists. Those tools are useful — and incomplete.

Real phishing kits frequently sit on domains that look nothing like the victim brand. If your discovery stack only asks “does this hostname resemble ours?”, you will miss the clones that matter.

The failure mode (from real buyer discussions)

Operators report finding weaponized clones via visual similarity (for example urlscan Pro-style screenshot matching) while Google has not indexed the page yet. When someone suggests DNSTwist, the reply is blunt: the phishing domain is unrelated to the real site — so string-distance tools never surface it.

That is not an edge case. Attackers register disposable names, abuse trusted redirects, and pull your logo or homepage screenshot dynamically. The brand signal is in the page, not the FQDN.

What typosquat tools are good for

Treat them as a baseline, not the product.

What you need beyond DNSTwist

  1. Visual / structural similarity — compare screenshots or DOM structure to your official pages (including when the hostname is random).
  2. Brand-in-page signals — title, logo assets, copied HTML, form fields that say your product name.
  3. Source / asset fingerprints — shared JS, unique paths, favicon hashes, “who else hosts this kit.”
  4. Infrastructure context — cert transparency, hosting/CDN (including cases where host abuse is the wrong door).
  5. Evidence packaging — discovery without a registrar-ready pack still fails in the ticket queue. See the evidence pack guide.

A practical discovery loop

1. Seed — official homepage + login + checkout screenshots as references.

2. Hunt — NRD/typosquat pass plus visual/HTML similarity and brand-in-page search.

3. Validate — is it live phishing / payment theft / credential harvest, or a false friend?

4. Pack & submit — one-screen summary + attachments + correct abuse category.

5. Contain in parallel — blocklists / customer warn while the registrar ticket runs. Measure time-to-protection.

What this means for Brand Abuse Desk

Buyers do not need another feed of 10,000 lookalike registrations. They need high-confidence clone incidents — including unrelated domains — turned into evidence packs and submissions.

That is why our wedge is not “unlimited domain monitoring.” It is verified impersonation → evidence → abuse desk follow-up.

Next reading