This endpoint is extremely effective in finding phishing domains — especially when using the fuzziness feature.

​
Example

https://api.dns0.eu/names?q=paypal&root=1
;; Tue, Jul 11, 2023 12:27 AM (UTC)
paypall-llimiited.cf.

;; Mon, Jul 10, 2023 6:35 AM (UTC)
paypal-confirm.us.

;; Tue, Jul 11, 2023 5:36 AM ... Mon, Jul 10, 2023 5:35 AM (UTC) (a day)
paypal-iamnewmoney.co.

;; Mon, Jul 10, 2023 3:27 AM (UTC)
paypal-accountwoy.ph.

;; Sun, Jul 9, 2023 4:24 AM (UTC)
generateur-d--argent-paypal.ws.

...

​
Base URL

https://api.dns0.eu/names

​
Parameters

​
q
string

The keyword to search for (e.g. q=paypal).

This parameter supports anchoring.

​
root
boolean

Limit results to root domains (e.g. root=1).

​
fuzzy
[]string

Apply fuzziness to q. Accepts a comma-separated list of fuzzy algorithms, or all to apply them all.

Read more about the available algorithms here.

​
from
datetime

Limit results to names seen after this date (e.g. from=2022-01-01). Also accepts UNIX timestamp and relative times (e.g. from=-1M for a month ago).

​
to
datetime

Limit results to names seen before this date (e.g. to=2023-03-13). Also accepts UNIX timestamp and relative times (e.g. to=-1M for a month ago).

​
not_before
datetime

Limit results to names not seen before this date (e.g. not_before=2023-07-01). Also accepts UNIX timestamp and relative times (e.g. not_before=-1M for a month ago).

​
sort
string

Available sorts are first_seen (the default) or last_seen. Both are descending sorts (most recent first).

​
format
string

Available formats are json and dig. Default format is based on the Accept HTTP header.

​
limit
number

Limit the number of results (e.g. limit=10000). Defaults to 100, and up to 50000.

​
offset
number

Used for pagination. Defaults to 0.

​
Anchoring

You can use ^ or $ to anchor your search query to the beginning or the end of a name.

  • to find all login. subdomains, use q=^login.
  • to find all the subdomains of paypal.com, use q=.paypal.com$

​
Fuzziness

Attackers commonly alter the spelling of a domain name to trick users into thinking they are visiting a legitimate website. The fuzzy parameter lets you apply fuzziness to your search query and find those domains. It accepts a comma-separated list of algorithms (or all to apply them all). Note that the original q value will be kept as well.

​
swap

Swap characters with each other.

paypal
papyal
paypla
pyapal
...

​
omit

Removes a single character from the query.

paypal
paypl
papal
aypal
...

​
repeat

Repeats each character of the query.

paypal
payppal
paypaal
paaypal
...

​
add

Adds a single character at the end of the query.

paypal
paypal0
paypala
paypal-
...

​
typo

Replace each adjacent keyboard key in all positions.

paypal
laypal
pqypal
patpal
...

​
bitflip

Flips each bit of the query.

paypal
0aypal
pa9pal
payxal
...

​
hyphen

Insert hyphens in all positions.

paypal
pay-pal
p-aypal
payp-al
...

​
fatfinger

Insert each adjacent keyboard key in all positions.

paypal
pagypal
payupal
pzaypal
...

​
subdomain

Insert a dot in each position.

paypal
pay.pal
payp.al
p.aypal
...

​
vowels

Swap each vowel by other vowels.

paypal
paypol
peypal
paipal
...

​
homoglyph

Replace each character by all lookalike (often accented) characters.

paypal
pàypal
paypa1
paypaɫ
...