A dnstwist alternative for domain checks and AI agents

At a glance

dnstwist generates and checks lookalike domains

The dnstwist documentation, read November 12, 2026, describes a typosquatting checker that generates permutations of a supplied domain and checks which are actually in use. Its input is a single domain name or URL that you want to protect. The project identifies SOC teams, incident response teams, independent analysts and researchers among its users.

For registered permutations, dnstwist records NS, A, AAAA and MX DNS records. Optional WHOIS lookups add the creation date and registrar. Its documentation also describes HTML and screenshot comparisons against the original website, with page similarity reported as a percentage.

Results can be exported to CSV and JSON. The documented programming interface is a Python module whose dnstwist.run() function accepts the command-line options. The project publishes an official Docker image and links the browser scanner at dnstwist.it, which calls itself a phishing domain scanner.

Bewary returns scam verdicts through REST and MCP

Bewary is a scam detection API and MCP server for apps and AI agents. It looks up domains, links, IP addresses, phone numbers, SMS short codes, email addresses, crypto wallets, IBANs, mobile apps and payment handles. Separate endpoints assess an account's contact points, find related domains and create watches.

Every check and lookup returns a typed JSON envelope with verdict, p_scam, reason_codes, classification, entities and signals. Verdicts are scam, suspicious, safe or unknown. Unknown means insufficient evidence or a failed source, and your code should never treat it as safe.

The reason_codes field lists the deciding codes strongest first. Entities carry typed facts and the datasets checked, while signals identify their source class, weight, dataset and coverage. The overall p_scam value ranges from 0 to 1 and is not yet calibrated against labelled data.

The remote MCP server at https://api.bewary.app/mcp runs the same code as the REST API. Claude, ChatGPT, Cursor, VS Code and other MCP clients receive structured answers with outputSchema and structuredContent. Related domains, assessments, watches and events have their own typed response objects.

Responses follow contract version 1.16.0. Within /v1, changes only add fields, enum values and reason codes. Existing fields and codes are never renamed or removed.

dnstwist is stronger for configurable permutation scans

dnstwist exposes the domain-generation process through configurable fuzzers. Its documentation lists addition, bitsquatting, Cyrillic, homoglyph, hyphenation, insertion, omission, plural, repetition, replacement, subdomain, transposition, vowel-swap and dictionary techniques. You can supply a dictionary file, and the project ships sample dictionaries of words common in phishing campaigns.

The homoglyph fuzzer uses Unicode lookalikes that registries accept, so the generated candidates are registrable in practice. The documented HTML comparisons use ssdeep or TLSH fuzzy hashes, while screenshot comparisons use perceptual hashes. Its rogue MX detection addresses lookalikes that could receive misdirected email.

dnstwist also gives its operator control over DNS resolution. Its documentation supports your own resolver or a specified external DNS or DNS-over-HTTPS server. The Apache License 2.0 permits modification and distribution on its terms, including use inside commercial products.

dnstwist does not check every possible variant, so it sticks to the closest lookalikes. HTML similarity rarely reaches 100%, and a phishing page with different source code can be missed.

Bewary differs in inputs, evidence and agent integration

The documented dnstwist input is a domain name or URL. Bewary also accepts identifiers such as phone numbers, email addresses and wallets, so an app can check several contact points through the same lookup contract. Batch responses retain the envelope used by individual lookups.

Bewary's typosquatting detection API takes one supplied host at GET /v1/domain/{host} and returns the registration date, expiry date and registrar from RDAP, plus the age in days. It reports whether the name imitates a brand through a homoglyph, typo, brand plus extra words or brand plus a scam word. It also returns how often the host's TLD is used for scams and whether the host is on Bewary's scam list.

A domain under 30 days old raises the risk, but age alone never makes a domain suspicious because new businesses register domains too. A host on a shared platform such as vercel.app, github.io or sites.google.com receives no credit for the platform's age.

Bewary reads new TLS certificate names from certificate transparency logs and keeps brand-imitating names as candidates. It checks those candidates again over three days before confirmed ones enter the scam list. On November 6, 2026, that list held 715,887 active domains.

The OpenAPI specification types every response, and Bewary publishes TypeScript types and Python models. Stable reason codes support application decisions and stored audit records. Lookups use no language model, and the answer is always Bewary's own verdict.

The public dataset directory reports each dataset's geography, kind, covered entity types and active entry count. For scam lists, it also reports how many entries are aimed at each country.

A lookup keeps no record of who asked. It can add the queried value to Bewary's data, including queuing a domain for web-archive history or recording an app as seen on its store. API keys are stored as SHA-256 hashes.

Free use and commercial terms differ

dnstwist's Apache License 2.0 grants free, royalty-free rights to reproduce, modify, sublicense and distribute the code under the license's terms. Its pages, consulted on November 12, 2026, require operators to provide DNS capacity for thousands of lookups in a short time and, for screenshot comparison, plenty of free memory.

Every call needs a key. A free key gets 1,000 credits a month, no card. Bewary's free credit allowance applies across its endpoints, and the free website checkers allow 10 checks a day per visitor without a key.

Bewary's keyed rate limit is 600 requests a minute. A batch request accepts up to 1,000 values and charges 1 credit per item. The OpenAPI specification and GET /v1/datasets are available without a key, but domain lookups, MCP tools and CLI commands require one.

Bewary publishes credit prices for volume

dnstwist's GitHub pages, read November 12, 2026, publish no price for the code or its Docker image: it is free code its user runs.

Bewary sells prepaid credits without a subscription, and purchased credits never expire. Packs cost $20 for 10,000 credits, $100 for 60,000 credits, $500 for 375,000 credits and $2,000 for 2,000,000 credits. Published rates range from $2.00 down to $1.00 per 1,000 credits.

A standard domain lookup costs 1 credit, while a deep domain lookup costs 30 credits. Related domains cost 5 credits per page of up to 50 results. A brand watch costs 1 credit a day, charged a day ahead, plus 1 credit per lookalike event.

Moving a lookalike domain check from dnstwist to Bewary's domain lookup API

A Bewary domain lookup does not replace dnstwist's permutation scan. The documented dnstwist workflow discovers registered lookalikes of a supplied domain, while Bewary's domain endpoint returns risk evidence about the host you supply. Keep that distinction when moving an application check.

Call dnstwist.run() from Python with the domain name or URL you want to protect as its input. The function accepts the same options as the command line. It generates domain permutations and checks which are in use.

For one host in the dnstwist output, GET /v1/domain/{host} returns the RDAP registration date, expiry date and registrar, the brand imitation technique and Bewary's verdict. The lookup costs 1 credit. We measured a median of 449 ms from Europe on October 23, 2026, with each input sent for the first time. This request requires your API key. curl "https://api.bewary.app/v1/domain/paypal-login-secure.top"

Read reason_codes and the entity facts alongside verdict. Never treat unknown as safe. For an agent integration, lookup_domain performs the same lookup through MCP.

Both tools fit a discovery and assessment workflow

An app can use dnstwist's documented permutation generation to discover registered lookalikes, then submit selected hosts to Bewary for domain risk evidence. Keep the scan's DNS records and similarity results alongside Bewary's verdict and reason codes. A similarity percentage and a scam probability describe different measurements.

For ongoing lookalike domain monitoring, a Bewary brand watch produces events for new brand lookalikes. Your app can read events through GET /v1/events or receive signed webhooks. Domain watches separately report changes such as IP addresses, name servers, expiry, re-registration and listing status. A domain watch also reports whether a domain is up, down or parked.

Related domain lookups provide another investigation path through shared infrastructure and website attributes in Bewary's own data. Results identify each relation's strength and each domain's verdict. Common infrastructure providers appear as excluded pivots with an explanation, so your app can distinguish those pivots from followed relationships.

Relations include a shared IP address, /24 or ASN, name servers, certificate, registrar and registration time, page template or tracking id. Name server relations come from hourly DNS history.

Questions

Sources

1. github.com: Dnstwistgithub.com/elceef/dnstwist
2. github.com: Dnstwist.pygithub.com/elceef/dnstwist/blob/master/dnstwist.py
3. github.com: LICENSEgithub.com/elceef/dnstwist/blob/master/LICENSE
4. dnstwist.itdnstwist.it/
5. github.com: Releasesgithub.com/elceef/dnstwist/releases