openSquat: watching new domains for names that copy yours

Five kinds of name copying, and one daily feed

openSquat is an open source intelligence security tool that identifies cyber squatting threats targeting your brand or domains, and the threat taxonomy is the part that tells you what it actually catches.

| Threat Type | Description | |-------------|-------------| | Phishing | Fraudulent domains mimicking your brand | | Typosquatting | Domains with common typos, such as gooogle.com | | IDN Homograph | Look-alike characters from other alphabets | | Doppelgänger | Domains containing your brand name | | Bitsquatting | Single-bit errors in domain names |

That last row is the one people miss. Bitsquatting is not a typo at all; it is a domain that differs from yours by a single bit in its encoding, which no human reading a list of names would ever notice and which a string distance function would score as nearly identical.

The mechanism is a feed, not a crawler. The daily NRD feed is a list of newly registered domains, and the tool scans that list each day. The community mode downloads a free NRD feed of roughly 100k domains a day and runs the detection locally, so the daily volume of new registrations is the raw input and your keyword list is the filter.

The detection engine is the Levenshtein distance algorithm, which measures how many single character edits turn one string into another. That is the right primitive for typos and bit errors, and the homoglyph handling is what extends it to the IDN case.

The project is on PyPI as opensquat at version 2.3.0, GPL-3.0-only, requires Python 3.10 or newer, and is classified as Production/Stable. The homepage is opensquat.com and the last push to the master branch was on 2026-08-01.

Installing it, and the two ways to run it

The pip route is the recommended one and takes two commands:

pip install opensquat
opensquat -k keywords.txt

The keyword file is how you tell the tool which names to protect, and the repository ships one, keywords.txt, alongside generic.txt and two other files, api_key.txt and vt_key.txt, which are the credential files for the paid mode and for the VirusTotal integration respectively.

The clone route is for working on the code:

git clone https://github.com/atenreiro/opensquat
cd opensquat
pip install -r requirements.txt
python3 opensquat.py -k keywords.txt

The README adds a note for repository users: in all the examples, replace opensquat with python3 opensquat.py to run from a cloned checkout. That is a small detail, but it is the kind of instruction that saves a new user a confusing error message when a flag is not recognised.

The runtime dependencies are eight, and two of them are the interesting ones. confusable_homoglyphs and homoglyphs, both at 2.0.0 or newer, are the libraries that do the look-alike character work, and they are what turn a string comparison into a genuine homograph check. Then colorama for terminal colour, requests and urllib3 for HTTP, beautifulsoup4 with dnspython for the DNS and web validation, and soupsieve.

Two of the requirements carry a comment explaining why they are there even though nothing imports them directly: urllib3 and soupsieve are pinned by Snyk to avoid a vulnerability. That is a small sign of a project that watches its dependency advisories.

The console script is registered as opensquat = opensquat.cli:main, and the package ships its text data files as package data, which is how the keyword and key files end up in the installed package rather than only in the checkout.

Validation flags, and what each one adds to a match

A domain that merely looks similar is a lead, not a finding, and the validation options are how you turn a list of candidates into a list of things to act on.

# DNS validation via Quad9
opensquat --dns

# Check Certificate Transparency logs
opensquat --ct

# Scan for open ports (80/443)
opensquat --portcheck

# Cross-reference phishing databases
opensquat --phishing results.txt

Each of these answers a different question. Quad9 DNS validation asks whether the domain resolves to something malicious, using a filtering resolver. Certificate Transparency logs show whether the domain has obtained a certificate, which is both a signal that it is being used and a source of its certificate issuance date. The port check asks whether anything is serving on 80 or 443, which distinguishes a parked or abandoned domain from a live phishing site. And the phishing database cross-reference takes a results file and checks the names in it against known lists.

VirusTotal is listed separately as a key feature, for domain reputation, and the repository carries a vt_key.txt for it.

The output formats are the other half:

# Save as JSON
opensquat -o results.json -t json

# Save as CSV
opensquat -o results.csv -t csv

So a run produces a file you can hand to another tool, and the phishing cross-reference then takes that file as its input, which means the workflow is scan, export, then validate.

The Confidence Levels table is the parameter that decides how much you get, and the description is honest about the direction of the trade. Level 0 is very high with fewer results and high accuracy, level 1 is high and is the default, level 2 is medium, level 3 is low, and level 4 is very low with more results and more false positives.

The default of level 1 is a sensible starting point, but the choice is a volume decision, not a quality decision. On a large brand the number of look-alikes even at high confidence can be large, and lowering the level to reduce the noise also raises the chance of missing the one that matters.

The open-core model and the three operating modes

openSquat follows an open-core model, and the README states the two halves of it: the core detection engine is open source and community driven, while advanced capabilities are delivered through commercial intelligence services. The stated reasoning is that the model enables transparency and community collaboration while supporting the scale, reliability and operational requirements of enterprise use.

Concretely, there are three modes, and the table is worth reading carefully because the difference between them is not only the feed.

Community is the default and needs no flags. It downloads the free NRD feed of roughly 100k domains a day and runs local Levenshtein detection.

Premium Feed, with the --premium flag, downloads the paid NRD feed, named nrd-lite and described as much larger, using your openSquat API key, and then runs the same local Levenshtein detection. The detection logic is identical; only the input is bigger.

Premium API, with the --api flag, skips the local feed download entirely and queries the openSquat lookalike REST API per keyword, returning server-side matches.

That third mode is the one that changes the trust model. The first two run the detection on your machine, so your keyword list never leaves and the matches are produced by code you can read. The third sends each keyword to a hosted service and takes the answer back.

The two Premium modes share a single openSquat API key, and you get one by signing up at opensquat.com. The API side also has a different confidence model: the five confidence levels map to four fuzziness values of exact, low, auto and high, with -c 3 and -c 4 both mapping to high, and you can override the mapping with --api-fuzziness.

For a security team the practical question is which side of that line you want to be on. If the keywords are your brand names and your monitoring is a threat hunt, keeping detection local and only paying for a larger feed is the more defensible setup.

What it takes to act on a result

The last part of the picture is the automation section and the reference writing around it, and together they turn the tool from a script into a process.

The README has an Automation section and an MCP Server section in its table of contents, and the second one is the more interesting development. An MCP server exposes the detection to an AI agent over a standard protocol, so a security workflow can ask for newly registered look-alikes of a brand as part of a larger triage process rather than a human running a cron job and reading a CSV.

The repository layout supports that reading. There is an opensquat.py at the top level and an opensquat/ package directory, with the console script pointing at opensquat.cli:main, and the package data shipping the text files. The keywords.txt, generic.txt, api_key.txt and vt_key.txt at the top level are the data the tool reads, and the fact that key files sit in the repository root is worth a moment of attention before you clone and run anything.

There are also the tests/ directory, a CHANGELOG, a CODE_OF_CONDUCT.md, a CONTRIBUTING.md and a screenshots/ directory, and the project has been written up in a few places outside its own README. A WhoisXML API blog called it a swiss army knife for brand protection, SOCRadar ranked it in its top five phishing detection tools, and a paper in the Journal of Information Security and Cybercrimes Research reports it identifying 103 squatting domains, 960 active phishing websites and 53 domains with suspicious certificates.

That academic result is the kind of figure worth reading carefully rather than repeating. It is a report of what one run against one set of keywords found, and the ratio of 960 active phishing websites to 103 squatting domains is a reminder that the two categories in the threat table behave differently in practice. A squatting domain is a name; a phishing website is something serving a page. The tool finds the first and then, with the validation flags, tells you which of them are live.

Editorial conclusion

Adopt openSquat if your organisation has a brand name that can be typed wrongly, because the daily newly registered domain feed and a Levenshtein distance check find the look-alikes within a day or two of registration, which is the window in which a phishing domain is still cheap to take down. Do not adopt it expecting it to be a complete phishing defence, because it detects registrations, not live attacks, and the confidence levels are a recall and precision trade you have to tune. Before you run it, understand the open-core model, because the community mode downloads a free feed of roughly 100k domains a day and the paid modes need an API key, and check the licence and any third party key files in the repository before you commit to a deployment.

Frequently asked questions

Official sources

1. atenreiro/opensquat on GitHub
2. Issues
3. License: GPL-3.0
4. Project website
5. README