/names
This endpoint is extremely effective in finding phishing domains — especially when using the fuzziness feature.
Example
;; Tue, Jul 11, 2023 12:27 AM (UTC)
paypall-llimiited.cf.
;; Mon, Jul 10, 2023 6:35 AM (UTC)
paypal-confirm.us.
;; Tue, Jul 11, 2023 5:36 AM ... Mon, Jul 10, 2023 5:35 AM (UTC) (a day)
paypal-iamnewmoney.co.
;; Mon, Jul 10, 2023 3:27 AM (UTC)
paypal-accountwoy.ph.
;; Sun, Jul 9, 2023 4:24 AM (UTC)
generateur-d--argent-paypal.ws.
...
Base URL
https://api.dns0.eu/names
Parameters
The keyword to search for (e.g. q=paypal).
This parameter supports anchoring.
Limit results to root domains (e.g. root=1).
Apply fuzziness to q. Accepts a comma-separated list of fuzzy algorithms, or
all to apply them all.
Read more about the available algorithms here.
Limit results to names seen after this date (e.g. from=2022-01-01). Also
accepts UNIX timestamp and relative times (e.g. from=-1M for a month ago).
Limit results to names seen before this date (e.g. to=2023-03-13). Also
accepts UNIX timestamp and relative times (e.g. to=-1M for a month ago).
Limit results to names not seen before this date (e.g.
not_before=2023-07-01). Also accepts UNIX timestamp and relative times (e.g.
not_before=-1M for a month ago).
Available sorts are first_seen (the default) or last_seen. Both are
descending sorts (most recent first).
Available formats are json and dig. Default format is based on the
Accept HTTP header.
Limit the number of results (e.g. limit=10000). Defaults to 100, and up to
50000.
Used for pagination. Defaults to 0.
Anchoring
You can use ^ or $ to anchor your search query to the beginning or the end of a name.
- to find all
login.subdomains, useq=^login. - to find all the subdomains of
paypal.com, useq=.paypal.com$
Fuzziness
Attackers commonly alter the spelling of a domain name to trick users into thinking they are visiting a legitimate website. The fuzzy parameter lets you apply fuzziness to your search query and find those domains. It accepts a comma-separated list of algorithms (or all to apply them all). Note that the original q value will be kept as well.
swap
Swap characters with each other.
paypal
papyal
paypla
pyapal
...
omit
Removes a single character from the query.
paypal
paypl
papal
aypal
...
repeat
Repeats each character of the query.
paypal
payppal
paypaal
paaypal
...
add
Adds a single character at the end of the query.
paypal
paypal0
paypala
paypal-
...
typo
Replace each adjacent keyboard key in all positions.
paypal
laypal
pqypal
patpal
...
bitflip
Flips each bit of the query.
paypal
0aypal
pa9pal
payxal
...
hyphen
Insert hyphens in all positions.
paypal
pay-pal
p-aypal
payp-al
...
fatfinger
Insert each adjacent keyboard key in all positions.
paypal
pagypal
payupal
pzaypal
...
subdomain
Insert a dot in each position.
paypal
pay.pal
payp.al
p.aypal
...
vowels
Swap each vowel by other vowels.
paypal
paypol
peypal
paipal
...
homoglyph
Replace each character by all lookalike (often accented) characters.
paypal
pàypal
paypa1
paypaɫ
...