shadom.co vs dnstwist
Two different jobs: dnstwist finds lookalike domains, shadom.co watches what happens to domains you already track.
What dnstwist does
dnstwist is an open-source (Apache-2.0) command-line tool and Python library. It generates domain name permutations, checks which are registered, and looks for typosquatting, homograph lookalikes using Unicode characters, and brand impersonation. It can also fetch candidate pages and compare them against your real site using fuzzy hashing (ssdeep/TLSH) and perceptual hashing (pHash) to flag phishing clones, and it checks for rogue MX hosts that could intercept misdirected email. Results export to CSV or JSON. A hosted version of the same engine runs at dnstwist.it.
dnstwist is a detection tool you run against your own brand: point it at your domain and it tells you what lookalikes exist right now. It is not a monitoring service and its README does not describe expiration tracking, drop-date prediction, or built-in alerting.
What shadom.co does
shadom.co monitors specific domains, yours or ones you are watching, for expiration dates, registrar and nameserver changes, and predicted drop dates using TLD-specific lifecycle timing. When something changes, you get an email, push, or webhook alert. It does not generate typosquat permutations or scan for phishing clones.
Using them together
A common workflow: run dnstwist to discover the typosquat and lookalike domains registered against your brand, then add the ones worth watching to a shadom.co watchlist so you know if they lapse, change hands, or drop, and can act (or catch the domain) at the right moment.
Frequently asked questions
Is dnstwist a competitor to shadom.co?
Not directly. dnstwist generates domain permutations (typosquats, homograph lookalikes) and checks which are registered, to help you find phishing or brand-impersonation domains. shadom.co monitors specific domains you already track for expiration, status changes, and drop dates. You can use both: dnstwist to discover lookalike domains, shadom.co to watch what happens to them over time.
Does dnstwist monitor domain expiration or drop dates?
No. dnstwist is a permutation and detection engine, not a monitoring service. Its README (github.com/elceef/dnstwist) documents typosquatting detection, homograph attacks, phishing webpage similarity checks, and rogue MX detection, but no expiration tracking, drop-date prediction, or alerting.
Can dnstwist send me alerts when a domain changes?
dnstwist is a command-line tool and Python library you run yourself; it does not run as a hosted alerting service. shadom.co sends email, push, and webhook notifications automatically when a monitored domain expires, changes registrar or nameservers, or approaches its drop date.
Is dnstwist free?
Yes. dnstwist is open source under the Apache-2.0 license and free to run. A hosted version is also available at dnstwist.it. shadom.co is free for up to 100 monitored domains with no credit card required.