Package: opensquat
openSquatWhat is openSquatopenSquat is an opensource Intelligence (OSINT) security tool to identifycyber squattingthreats to specific companies or domains, such as:Phishing campaignsDomain squattingTypo squattingBitsquattingIDN homograph attacksDoppenganger domainsOther brand/domain related scamsIt does support some key features such as:Automatic newly registered domain updating (once a day)Levenshtein distance to calculate word similarityFetches active and known phishing domains (Phishing Database project)IDN homograph attack detectionIntegration with VirusTotalIntegration with Quad9 DNS serviceUse different levels of confidence threshold to fine tuneSave output into different formats (txt, JSON and CSV)Can be integrated with other threat intelligence tools and DNS sinkholesAs an opensource project, everyone's welcome to contribute.Screenshot / Video DemoCheck the 40 secondsDemo Video(v1.95)Demo / ForksPhishy Domainsfor a simple web version of the openSquat.openSquat Botfor a simple Telegram bot.RapidAPIto integrate your application with openSquat using REST API.Note: The forks do not contain all the openSquat features.How to Installgitclonehttps://github.com/atenreiro/opensquatpipinstall-rrequirements.txtMake sure you havePython 3.6+andpip3in your environmentHow to Update:warning:when updating: especially for a major release, re-run the pip install to check for new dependencies.To update your current version, just type the following commands inside the openSquat directory:gitpullpipinstall-rrequirements.txtThe "pip install" is just to make sure no new libs were added with the new upgrade.Usage ExamplesEdit the "keywords.txt" with your customised keywords to hunt.# Lazy run with default optionspythonopensquat.py# for all the optionspythonopensquat.py-h# Search for generic terms used in phishing campaigns (can lead to false-positives)pythonopensquat.py-kgeneric.txt# With DNS validation (quad9)pythonopensquat.py--dns# Subdomain searchpythonopensquat.py--subdomains# Check for domains with open ports 80/443pythonopensquat.py--portcheck# With Phishing validation (Phishing Database)pythonopensquat.py--phishingphish_results.txt# Save output as JSONpythonopensquat.py-oexample.json-tjson# Save output as CSVpythonopensquat.py-oexample.csv-tcsv# Conduct a certificate transparency (ct) huntpythonopensquat.py--ct# Period search - registrations from the last month (default: day)pythonopensquat.py-pmonth# Tweak confidence level. The lower values bring more false positives# (0: very high, 1: high (default), 2: medium, 3: low, 4: very lowpythonopensquat.py-c2# All validations optionspythonopensquat.py--phishingphishing_domains.txt--dns--ct--subdomains--portcheckAutomations & IntegrationsYou can set up openSquat to run automatically using a task scheduler (such as crontab for Linux) to generate a new list of results daily.We update our feeds with a fresh new list of domains every day around 7.30 am (UTC+0 / GMT+0)# Crontab example - run openSquat every day at 8 am# In this example, the results are saved to a JSON file format08***/home/john/opensquat/opensquat.py-kkeywords.txt-oresults.json-tjsonYou can use this output file to feed your SIEM, SOAR, or other tools that support importing from TXT/JSON/CSV formats.Alternatively, currently in aBeta previewyou can integrate using REST APIs, your application withRapidAPIDo you have an integration idea or would like to share an integration you developed with our community? Open a GitHub issue or send me an email.To Do / RoadmapIntegration with VirusTotal (VT) for subdomains validationIntegratration with VirusTotal (VT) for malware detectionUse certificate transparencyHomograph detectiondoneImprove code quality from B to A grade (codacy)PEP8 complianceAND logical condition for keywords search (e.g: google+login) - Thanks to Steff T.Enhanced documentationFeature RequestTo request a new feature, create a "new issue" and describe the feature and potential use cases. You can upvote the "issue" and contribute to the discussions if something similar already exists.ChangelogCheck theCHANGELOGfile.AuthorsProject founderAndre Tenreiro(LinkedIn)andre+nospam@opensquat.com- remove the "nospam" -PGP KeyContributorsPlease check the contributors page on GitHubHow to helpYou can help this project in many ways:Providing your time and coding skills to enhance the projectBuild a decent but simpleproject webpageProvide access to OSINT feedsOpen new issues with new suggestions, ideas, bug report or feature requestsSpread this project within your networkShare your story how have you been using the openSquat and what impact it brought to you