Skip to content
Get packs

Typosquatting Domain Analysis

Finds lookalike domains that could be used for phishing or brand impersonation

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can take your company's domain and generate many similar-looking variations, such as misspellings, swapped letters, or characters that look alike, then check which of those variations are actually registered and live on the internet. It is aimed at spotting lookalike domains that could be used to impersonate a brand in phishing attacks. The skill's instructions also describe comparing web page look-alikeness, though the excerpted code shows only part of that workflow.

Great for

  • Security analysts who monitor for brand impersonation and phishing domains
  • Teams investigating a suspicious domain reported by employees or customers
  • Developers building a lookalike-domain monitoring tool for an organization

Skip it if

  • Attacking or impersonating others: the output is a list of lookalike domains that could be misused, so it should be used only for defensive monitoring and takedown requests with authorization
  • Organizations expecting a complete or authoritative list: the permutations are heuristic and DNS results only show registration, not intent
  • Non-technical users without Python and command-line experience, since setup and interpreting results require it

Try asking

  • “Scan example.com for registered typosquatting and homograph domains and list the risky ones”
  • “Investigate whether login-acme-secure.net is a phishing clone of our site”
  • “Assess brand-impersonation risk for our company domain and prioritize results by likely threat”
  • “Generate a list of permutations for my domain and check which resolve in DNS”
Step-by-step guide: how to use Typosquatting Domain AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-typosquatting-domains-with-dnstwist.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-typosquatting-domains-with-dnstwist.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-typosquatting-domains-with-dnstwist.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run only against domains you own or are authorized to investigate, and review the DNS queries it sends before scanning at scale
  • Treat registered lookalike domains as leads to verify, not confirmed attacks; check page content and WHOIS before escalating
  • Read scripts/agent.py before running it: the excerpt shows a simplified permutation generator and an import of a dnstwist library, so confirm which code path actually executes

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.