简体中文
EnglishWhat Is DNS Twister and What Does It Do?
Updated
DNS Twister is a domain monitoring and protection service that watches for look-alike and impersonation domains targeting your brand. It checks your domain against more than 1 billion registered SSL certificates and monitors over 5 million newly registered certificates daily, then alerts you to risks such as typosquatting, phishing setups, and MX record changes that could let attackers send email as your brand. A free domain check is available with no email or credit card required; deeper scans and ongoing monitoring require a paid subscription.
What problem it solves
Domain-based scams don't require breaking into your systems. An attacker registers a name one character off from yours, issues a certificate, and uses it to phish your customers or damage your brand. DNS Twister's stated purpose is to catch these domains before they're used against you, rather than after customers report them.
The site frames the stakes with two figures: 3.4 billion (described as the average downtime a company experiences after a ransomware attack) and 24 days (described as the number of phishing emails sent globally every single day — note the unit mismatch in the source, which appears to be an error on the page).
How it works
- You enter your domain in the free check tool. No email or credit card is required for this step.
- It scans against a large certificate dataset — over 1 billion registered SSL certificates — to find names that resemble yours.
- It monitors new certificates continuously, at a rate of 5 million+ newly registered certificates per day, so newly created impersonation domains surface as they appear.
- Subscribers get real-time alerts on critical changes, including the creation of MX records that could enable an attacker to send phishing email from a look-alike domain.
The MX record alert is the operationally important one: a look-alike domain alone is mostly a nuisance, but a look-alike domain with working mail is a live phishing channel aimed at your customers.
Free check vs. paid subscription
| Free domain check | Paid subscription | |
|---|---|---|
| Cost | Free | $4.99 (as listed on the site) |
| Email or credit card required | No | Yes (account/subscription) |
| Scan depth | Basic | Deeper, more detailed scan |
| Ongoing monitoring | No | Yes |
| Real-time alerts (e.g., MX record creation) | No | Yes |
The site also references a free trial and a subscription login/management page, so you can evaluate the paid tier before committing.
Who it's built for
The site lists banks, insurance companies, cybersecurity teams, investment firms, software companies, influencers, and small businesses as users, and says it monitors thousands of domains. The practical dividing line is whether your brand name is worth impersonating:
- Likely a fit: you have customers who receive email from you, a recognizable brand, or a domain that phishers would profit from spoofing.
- Probably not a priority: a personal or internal-only domain with no external trust relationship.
What to check before subscribing
- Confirm the alert channel and response workflow. Detection only helps if someone acts on the alert; decide in advance who receives it and what they do (for example, a takedown request — the site's blog includes a DNS takedown email template).
- Verify the current price and trial terms on the subscription page, since pricing and plan details can change.
- Decide whether you need monitoring or just a one-time audit. The free check tells you what exists today; impersonation domains appear continuously, which is the case for the subscription.