otacon 1.0.0

Otacon finds domains impersonating yours — typosquats, homoglyph fakes, combosquats, IDN/punycode tricks and more. It generates hundreds of variants, checks which are actually registered, and scores each by real-world phishing risk. One command, ~10 seconds, no paid APIs.

⚠ 3 registered · crit: 1 · mx: 1 · fresh <7d: 1

Otacon · target: github.com
┌──────────────────────────────────────┬────────────────┬────────┬───────┬───────┬───────┬─────────┐
│ Domain                               │ Risk           │    Age │  DNS  │  MX   │  SSL  │  HTTP   │
├──────────────────────────────────────┼────────────────┼────────┼───────┼───────┼───────┼─────────┤
│ githubupdate.com                     │ ███████░  92   │     3d │   ✓   │   ✓   │   ✓   │   200   │
│ combosquat                           │                │        │       │       │       │         │
│ "GitHub - Security Update Required"  │                │        │       │       │       │         │
│ bithub.com                           │ █████░░░  68   │     2y │   ✓   │   —   │   ✓   │   301   │
│ typo                                 │                │        │       │       │       │         │
│ githuub.com                          │ ████░░░░  48   │    8mo │   ✓   │   —   │   —   │   404   │
│ typo                                 │                │        │       │       │       │         │
└──────────────────────────────────────┴────────────────┴────────┴───────┴───────┴───────┴─────────┘
Permutations: 143 · registered: 3 · med: 1 · high: 1 · crit: 1

Table of contents

• Why Otacon?
• Quick start
• Install
• Usage
• Modes
• Output formats
• How scoring works
• Detection techniques
• CI/CD integration
• Interactive mode
• Whitelist / defensive flag
• Comparison with dnstwist
• FAQ
• Troubleshooting
• Contributing & development
• License & ethics

Why Otacon?

Phishing campaigns almost always start with a lookalike domain. Attackers register github-update.com, paypa1.com, goog1e.com weeks (or days) before the actual attack. By the time anyone notices, credentials are already gone.

Otacon is built for the people who need to find those domains before the attack lands:

Otacon is fully passive: DNS queries, a TLS handshake, one HTTP GET per variant. No exploit attempts, no auth, no scraping at scale.

Quick start

pipx install git+https://github.com/notimeftnoir/otacon.git
otacon scan example.com

That's it. You get a colored terminal table, ranked by risk, in about 10 seconds.

Need a wordlist without network checks? otacon generate example.com -o wordlist.txt Want guided mode? Just run otacon with no arguments.

Install

Recommended — isolated global install via pipx:

pipx install git+https://github.com/notimeftnoir/otacon.git

Alternative — standard pip into any active virtual environment:

pip install git+https://github.com/notimeftnoir/otacon.git

macOS / Kali / Debian: the aiodns dependency needs the c-ares system library. brew install c-ares (macOS) · sudo apt install libc-ares-dev (Debian/Kali/Ubuntu)

Windows: no extra deps — wheels are prebuilt. Otacon auto-switches to SelectorEventLoop to avoid known Proactor issues.

git clone https://github.com/notimeftnoir/otacon.git
cd otacon
python3 -m venv .venv
source .venv/bin/activate        # Linux / macOS
.venv\Scripts\activate           # Windows (PowerShell)
pip install -e ".[dev]"
pytest && ruff check .

Usage

otacon                                        # interactive mode (guided prompts)
otacon scan example.com                       # one-shot scan, all signals
otacon scan example.com --no-http             # DNS only — faster, fewer signals
otacon scan example.com --all                 # include unregistered variants
otacon scan example.com --concurrency 100     # crank concurrency (default 50)
otacon scan example.com --exclude "alias.com,brand.io"
otacon scan example.com --exclude-file allowed.txt
otacon scan example.com --json r.json --html r.html --markdown r.md --csv r.csv
otacon scan example.com --fail-on high        # CI gate — exit 2 on high/critical
otacon scan example.com --weights-file weights.json  # custom scoring weights

# Scan multiple domains (sequential)
otacon scan github.com google.com example.com

# Scan from a file (one domain per line, # = comment)
otacon scan --domains-file brands.txt

# Combine: extra domains alongside a file
otacon scan mycompany.com --domains-file more_brands.txt

# Aggregated HTML report for all domains
otacon scan github.com google.com --html report.html

# Aggregated JSON export
otacon scan --domains-file brands.txt --json results.json

# Fail CI if any domain has a critical hit
otacon scan --domains-file brands.txt --fail-on critical

otacon generate example.com -o variants.txt   # wordlist only, no network
otacon --debug scan example.com               # global flags precede the subcommand
otacon --version                              # print version and exit

CLI flags reference

Placement matters: --debug/--quiet/--version belong to otacon itself and must come before the subcommand (otacon --debug scan example.com). Every other flag below belongs to scan and comes after it (otacon scan example.com --fail-on high).

Global options (before the subcommand):

scan options (after otacon scan):

{
  "points_mx": 30,
  "points_ssl_fresh": 15,
  "kind_base": { "homoglyph": 30 }
}

otacon scan example.com --weights-file weights.json

generate options (after otacon generate):

Exit codes (for CI gating)

Modes

Otacon has two subcommands plus an interactive guided mode:

Output formats

One scan, five ways to consume it. Pick the one that fits your workflow:

You can pass all export flags at once — every format is rendered from the same in-memory report, so they always agree.

JSON structure (excerpt)

{
  "target": "github.com",
  "started_at": "2026-06-08T14:23:01+00:00",
  "total_permutations": 143,
  "results": [
    {
      "domain": "githubupdate.com",
      "kind": "combosquat",
      "resolves": true,
      "has_mx": true,
      "has_ssl": true,
      "http_status": 200,
      "page_title": "GitHub - Security Update Required",
      "created_at": "2026-06-05T09:12:00+00:00",
      "age_days": 3,
      "risk_score": 92,
      "risk_level": "critical",
      "risk_reasons": [
        "technique: combosquat (+20)",
        "resolves to an IP (+10)",
        "has an MX record — ready for email phishing (+25)",
        "active SSL certificate (+15)",
        "responds HTTP 200 — active site (+15)",
        "registered 3 days ago (+20)"
      ],
      "is_likely_defensive": false
    }
  ]
}

Every score is fully decomposed — you can always answer "why did this get 92?".

How scoring works

Every score is the sum of explicit, explainable signals — no ML, no black box. Every reason is exposed in the JSON export (risk_reasons) and in the interactive detail view.

Risk levels

📐 Full architecture, pipeline, and design rationale → docs/DESIGN.md

Detection techniques

Otacon implements 12 permutation techniques modeled on real-world attacks. The homoglyph table is cross-checked against Unicode's own confusables.txt so every look-alike character is a documented substitution, not a guess — it covers all 26 letters, not just the handful that are easy to eyeball.

Every example above is real output, not an illustration. Two details worth knowing before you read a report:

• Unicode look-alikes are emitted as punycode. Swapping the l in example.com for a Polish ł is reported as xn--exampe-7db.com, because that is the name DNS actually resolves and the form you will see in logs. Those land under IDN, which leaves the Homoglyph rows for the ASCII confusables (1/l, 4/a, rn/m).
• Each variant is reported once, under the first technique that produced it. Techniques overlap, and the priority order is the one in this table. That is why examples.com is labelled a typo rather than a plural for a target like example.com: s sits next to e on QWERTY, so the typo generator reaches it first. On shop.com, where no adjacent key produces it, shops.com comes through as a plural.

The generator deduplicates results and never includes the original domain in the output.

CI/CD integration

Add a brand-protection gate to your release pipeline. If a critical impersonation goes live, the pipeline fails.

GitHub Actions

name: brand-protection
on:
  schedule:
    - cron: "0 6 * * *"   # daily at 06:00 UTC
  workflow_dispatch:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: sudo apt-get install -y libc-ares-dev
      - run: pip install git+https://github.com/notimeftnoir/otacon.git
      - run: otacon scan example.com --json report.json --fail-on critical
      - if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: otacon-report
          path: report.json

GitLab CI

brand-protection:
  image: python:3.12
  before_script:
    - apt-get update && apt-get install -y libc-ares-dev
    - pip install git+https://github.com/notimeftnoir/otacon.git
  script:
    - otacon scan $CI_PROJECT_NAME.com --html report.html --fail-on high
  artifacts:
    when: always
    paths: [report.html]
  only: { refs: [schedules] }

Interactive mode

Run otacon with no subcommand for a guided experience. After the scan, you can act on each registered domain individually:

Action for githubupdate.com:
  [*] [o]pen   — open in browser
      [w]hois  — show registration info
      [e]xport — save result as JSON
      [a]llow  — skip in this session
      [r]escan — re-check this domain now
      [b]ack   — pick a different domain
      [q]uit   — exit actions

Designed for triaging a fresh scan without leaving the terminal: open the suspicious site, check WHOIS, decide to allow-list or escalate.

Whitelist / defensive flag

Brands often own their own lookalikes defensively (e.g., google.com owns gooogle.com and redirects it). Otacon flags these with ⚑ when the redirect points back to the original:

microsft.com    ⚑ → microsoft.com    crit(85) — but defensive

After the scan, Otacon offers to write all ⚑-flagged domains to whitelist.txt. Future runs in the same directory pick this file up automatically; you can also point at a custom file with --exclude-file path/to/list.txt.

Whitelist file format:

# defensive registrations, owned by us
gooogle.com
goggle.com
g00gle.com

Whitelisted domains are skipped before any network call — saving both time and quota.

Comparison with dnstwist

dnstwist is the OG tool in this space. Otacon and dnstwist solve overlapping problems with different priorities.

Use dnstwist if you want screenshots, fuzzy hashing, deeper enrichment. Use Otacon if you want an opinionated risk score, defensive-flag detection, and a CI-friendly exit code.

FAQ

Troubleshooting

If something still doesn't work, please open an issue with:

• Otacon version (otacon --version)
• Python version, OS, and architecture
• The full command and (if safe to share) the target
• The error message or unexpected behavior

Contributing & development

See CONTRIBUTING.md for the dev setup, lint, and test commands.

Quick summary:

git clone https://github.com/notimeftnoir/otacon.git
cd otacon
python -m venv .venv && source .venv/bin/activate  # or .venv\Scripts\activate
pip install -e ".[dev]"
pytest && ruff check .

Architecture deep-dive: docs/DESIGN.md.

Security disclosure policy: SECURITY.md.

License & ethics

MIT License. Use it freely.

Otacon is passive only — DNS queries, a TLS handshake, a single HTTP GET per variant. No exploit attempts, no brute-forcing, no auth.

Use only on:

• Domains you own
• Domains within an authorized security testing engagement (with written scope)
• Domains you have explicit permission to monitor

Do not use to: harass, dox, or build attack tooling. If you found this useful for a defense engagement, say hi — feedback shapes the roadmap.