This endpoint is extremely effective in finding phishing domains — especially when using the fuzziness feature.

​
Example

https://api.dns0.eu/names?q=paypal&root=1
;; Tue, Jul 11, 2023 12:27 AM (UTC)
paypall-llimiited.cf.

;; Mon, Jul 10, 2023 6:35 AM (UTC)
paypal-confirm.us.

;; Tue, Jul 11, 2023 5:36 AM ... Mon, Jul 10, 2023 5:35 AM (UTC) (a day)
paypal-iamnewmoney.co.

;; Mon, Jul 10, 2023 3:27 AM (UTC)
paypal-accountwoy.ph.

;; Sun, Jul 9, 2023 4:24 AM (UTC)
generateur-d--argent-paypal.ws.

...

​
Base URL

https://api.dns0.eu/names

​
Parameters

q
string

The keyword to search for (e.g. q=paypal).

This parameter supports anchoring.

root
boolean

Limit results to root domains (e.g. root=1).

fuzzy
[]string

Apply fuzziness to q. Accepts a comma-separated list of fuzzy algorithms, or all to apply them all.

Read more about the available algorithms here.

from
datetime

Limit results to names seen after this date (e.g. from=2022-01-01). Also accepts UNIX timestamp and relative times (e.g. from=-1M for a month ago).

to
datetime

Limit results to names seen before this date (e.g. to=2023-03-13). Also accepts UNIX timestamp and relative times (e.g. to=-1M for a month ago).

not_before
datetime

Limit results to names not seen before this date (e.g. not_before=2023-07-01). Also accepts UNIX timestamp and relative times (e.g. not_before=-1M for a month ago).

sort
string

Available sorts are first_seen (the default) or last_seen. Both are descending sorts (most recent first).

format
string

Available formats are json and dig. Default format is based on the Accept HTTP header.

limit
number

Limit the number of results (e.g. limit=10000). Defaults to 100, and up to 50000.

offset
number

Used for pagination. Defaults to 0.

​
Anchoring

You can use ^ or $ to anchor your search query to the beginning or the end of a name.

  • to find all login. subdomains, use q=^login.
  • to find all the subdomains of paypal.com, use q=.paypal.com$

​
Fuzziness

Attackers commonly alter the spelling of a domain name to trick users into thinking they are visiting a legitimate website. The fuzzy parameter lets you apply fuzziness to your search query and find those domains. It accepts a comma-separated list of algorithms (or all to apply them all). Note that the original q value will be kept as well.

​
swap

Swap characters with each other.

paypal
papyal
paypla
pyapal
...

​
omit

Removes a single character from the query.

paypal
paypl
papal
aypal
...

​
repeat

Repeats each character of the query.

paypal
payppal
paypaal
paaypal
...

​
add

Adds a single character at the end of the query.

paypal
paypal0
paypala
paypal-
...

​
typo

Replace each adjacent keyboard key in all positions.

paypal
laypal
pqypal
patpal
...

​
bitflip

Flips each bit of the query.

paypal
0aypal
pa9pal
payxal
...

​
hyphen

Insert hyphens in all positions.

paypal
pay-pal
p-aypal
payp-al
...

​
fatfinger

Insert each adjacent keyboard key in all positions.

paypal
pagypal
payupal
pzaypal
...

​
subdomain

Insert a dot in each position.

paypal
pay.pal
payp.al
p.aypal
...

​
vowels

Swap each vowel by other vowels.

paypal
paypol
peypal
paipal
...

​
homoglyph

Replace each character by all lookalike (often accented) characters.

paypal
pàypal
paypa1
paypaɫ
...