otacon 1.0.2

Install · Quick start · Techniques · Usage · Scoring · CI/CD · FAQ

Otacon finds domains impersonating yours — typosquats, homoglyph fakes, combosquats, IDN/punycode tricks and more. It generates hundreds of variants, checks which are actually registered, and scores each by real-world phishing risk. One command, ~10 seconds, no paid APIs.

_{Real output: a full scan of example.com — 234 permutations, 13 registered lookalikes, ranked by risk. Regenerate with python tools/render_demo_svg.py.}

Install

pipx install otacon      # isolated global install (recommended)
pip install otacon       # or into an active virtualenv

macOS / Debian / Kali: the aiodns dependency needs the c-ares system library — brew install c-ares or sudo apt install libc-ares-dev. Windows: no extra steps, wheels are prebuilt.

Quick start

otacon scan example.com                   # full scan: DNS, MX, TLS, HTTP, WHOIS
otacon scan example.com --no-http         # DNS only — roughly 3x faster
otacon scan example.com --fail-on high    # CI gate: exit 2 on high or critical
otacon generate example.com -o list.txt   # offline wordlist, no network traffic
otacon                                    # guided interactive mode

Global flags (--quiet, --debug, --version) go before the subcommand; everything else goes after it.

Reports are written with --json, --md, --html and --csv; pass as many as you like, since every format renders from the same in-memory report.

Why Otacon?

Phishing campaigns almost always start with a lookalike domain. Attackers register github-update.com, paypa1.com, goog1e.com weeks (or days) before the actual attack. By the time anyone notices, credentials are already gone.

Otacon is built for the people who need to find those domains before the attack lands:

Otacon is fully passive: DNS queries, a TLS handshake, one HTTP GET per variant. No exploit attempts, no auth, no scraping at scale.

Detection techniques

Otacon implements 12 permutation techniques modeled on real-world attacks. The homoglyph table covers all 26 letters, not just the handful that are easy to eyeball, and every Unicode entry in it is cross-checked against Unicode's own confusables.txt: 19 of the 25 share a UTS #39 skeleton with the letter they imitate. The other six (Cyrillic к, п, т, ь, plus ł and í) are kept on purpose — UTS #39 folds them elsewhere, but they render close enough in the sans-serif fonts browsers and mail clients use that real campaigns exploit them. Each of the six is labelled as such in the source, so nothing in the table is an unlabelled guess.

Every example above is real output, not an illustration. Each variant is reported once, under the first technique that produced it, and the original domain is never included — see docs/USAGE.md for why that matters when you read a report.

Documentation

Comparison with dnstwist

dnstwist is the OG tool in this space. Otacon and dnstwist solve overlapping problems with different priorities.

Use dnstwist if you want screenshots, fuzzy hashing, deeper enrichment. Use Otacon if you want an opinionated risk score, defensive-flag detection, and a CI-friendly exit code.

Contributing

See CONTRIBUTING.md for the dev setup and the lint gates, and SECURITY.md for the disclosure policy.

License & ethics

MIT License. Use it freely.

Otacon is passive only — DNS queries, a TLS handshake, a single HTTP GET per variant. No exploit attempts, no brute-forcing, no auth.

Use only on:

• Domains you own
• Domains within an authorized security testing engagement (with written scope)
• Domains you have explicit permission to monitor

Do not use to: harass, dox, or build attack tooling. If you found this useful for a defense engagement, say hi — feedback shapes the roadmap.