README
¶
Yet Another Typosquatting Tool (yatt)
yatt generates look-alike variants of a domain, resolves them over DNS, and reports which ones are
registered.
Run a typosquatting scan twice and most tools hand you the same wall of results both times. yatt
remembers: it keeps history, shows you what changed since last time, and never re-asks about a
domain you've already triaged.
Features
- A permutation technique for every squatting mechanism — typos, keyboard slips, homoglyphs, bitsquatting, dot insertion, TLD swaps (docs/techniques.md has the full list).
- Registration read from the NS rcode at the registrable domain, so parked, MX-only and delegation-only registrations are not missed.
- Per-zone wildcard (catch-all) detection, including registries that never answer NXDOMAIN.
- Concurrent resolution under a QPS ceiling.
- Scan history with cross-scan diff:
new/changed/unchanged/gone. - Persistent triage verdicts that survive every future scan.
- State in SQLite — a local file by default, or kept in S3 and shared across machines.
- Scan profiles, a config file, table/JSON/NDJSON output, and AbuseIPDB/Shodan enrichment links.
Installation
Download a prebuilt binary for your platform from the
latest release, extract it, and put yatt on
your PATH:
tar -xzf yatt_Linux_arm64.tar.gz # or unzip yatt_Darwin_arm64.zip on macOS
./yatt --version
With a Go toolchain you can install from source instead:
go install github.com/unicrons/yatt@latest
Or build the checkout directly (the devbox shell provides go, goose, golangci-lint, sqlite and gotestsum):
devbox shell
go build -o yatt .
./yatt --version
Quickstart
yatt scan example.com
Usage
yatt scan <domain> permute, resolve, record, and report
yatt history <domain> list the recorded scans of a seed
yatt diff <domain> compare the last two scans, without resolving
yatt triage <domain> <candidate> record a verdict on a candidate
yatt triage list <domain> list the verdicts recorded for a seed
yatt state push|pull|unlock manage a database kept in S3
Main global flags:
-o, --output string output format: table|json|ndjson (default "table")
--db string scan database path, or s3://bucket/key to keep it in S3
--resolver string upstream DNS resolver as host[:port] (default: the system resolver)
--qps float cap DNS queries per second across all workers (0 for unlimited)
Main scan flags:
--profile string scan profile: quick|full, or one defined in --config
--technique strings techniques to run (default: all)
--show-unregistered also report candidates nobody has registered
--status strings report only candidates with these triage statuses
--exclude-status strings report every candidate except those with these statuses
The full command and flag reference is in docs/cli.md.
Examples
yatt scan example.com
yatt scan example.com --show-unregistered
yatt scan example.com --technique omission,homoglyph --limit 50
yatt scan example.com --output json | jq '.[] | select(.has_mx)'
yatt scan example.com --resolver 1.1.1.1 --timeout 5s
yatt scan example.com --profile full
A verdict recorded once filters every future scan:
Documentation
| Doc | Covers |
|---|---|
| docs/cli.md | every command and flag, output streams, IDN/punycode handling |
| docs/techniques.md | the ten permutation techniques and what each one models |
| docs/registration.md | how "registered" is decided; zones that never say NXDOMAIN |
| docs/reporting.md | report ordering, the seed row, enrichment links |
| docs/state.md | scan history, diff, triage verdicts, and remote state in S3 |
| docs/configuration.md | scan profiles and the config file |
| docs/development.md | dev commands, package layout, regenerating the demo gifs |
Development
See docs/development.md: the devbox scripts (build, test, lint), the
package layout, and how the demo gifs regenerate.
Credits
The permutation algorithms are reimplemented in Go with reference to dnstwist (Apache-2.0) and ail-typo-squatting (BSD-2-Clause).
The homoglyph tables are derived from the Unicode Consortium's
confusables.txt, and the full TLD
list from the IANA Root Zone Database.
pkg/engine/data/PROVENANCE.md records the source behind every table, and which of them regenerate.
License
Licensed under the Apache License 2.0.
Made with ❤️ by unicrons.cloud 🦄
Documentation
¶
There is no documentation for this package.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package cmd wires the yatt command tree.
|
Package cmd wires the yatt command tree. |
|
internal
|
|
|
config
Package config resolves named scan profiles: presets for technique selection, TLD profile, concurrency, timeout, QPS and candidate limit.
|
Package config resolves named scan profiles: presets for technique selection, TLD profile, concurrency, timeout, QPS and candidate limit. |
|
enrich
Package enrich builds ready-to-open lookup links for a finding.
|
Package enrich builds ready-to-open lookup links for a finding. |
|
render
Package render turns findings into the output formats the CLI offers.
|
Package render turns findings into the output formats the CLI offers. |
|
resolver
Package resolver wraps github.com/miekg/dns with just enough surface for bulk look-alike scanning.
|
Package resolver wraps github.com/miekg/dns with just enough surface for bulk look-alike scanning. |
|
scan
Package scan orchestrates a single run: permute the seed, resolve every candidate, record the result, and compare it against the previous run.
|
Package scan orchestrates a single run: permute the seed, resolve every candidate, record the result, and compare it against the previous run. |
|
store
Package store persists scans and their findings.
|
Package store persists scans and their findings. |
|
store/migrations
Package migrations embeds the schema migrations and applies them.
|
Package migrations embeds the schema migrations and applies them. |
|
store/remote
Package remote keeps the state database in S3 instead of on local disk.
|
Package remote keeps the state database in S3 instead of on local disk. |
|
store/remote/remotetest
Package remotetest provides an in-memory fake of the S3 client for tests of the remote state backend.
|
Package remotetest provides an in-memory fake of the S3 client for tests of the remote state backend. |
|
triage
Package triage defines an analyst's verdict on a candidate domain.
|
Package triage defines an analyst's verdict on a candidate domain. |
|
wildcard
Package wildcard detects catch-all DNS zones.
|
Package wildcard detects catch-all DNS zones. |
|
pkg
|
|
|
engine
Package engine generates look-alike domain candidates from a seed domain.
|
Package engine generates look-alike domain candidates from a seed domain. |
|
engine/data
Package data holds yatt's generated permutation tables — keyboard adjacency, homoglyph substitutions, and TLD lists — so pkg/engine's technique code stays free of large literals.
|
Package data holds yatt's generated permutation tables — keyboard adjacency, homoglyph substitutions, and TLD lists — so pkg/engine's technique code stays free of large literals. |
|
engine/data/gen/glyphs
command
Command glyphs regenerates pkg/engine/data/glyphs_unicode.go from the Unicode Consortium's confusables.txt.
|
Command glyphs regenerates pkg/engine/data/glyphs_unicode.go from the Unicode Consortium's confusables.txt. |
|
engine/data/gen/tlds
command
Command tlds regenerates pkg/engine/data/tlds_iana.go from the IANA Root Zone Database's list of delegated top-level domains.
|
Command tlds regenerates pkg/engine/data/tlds_iana.go from the IANA Root Zone Database's list of delegated top-level domains. |
Click to show internal directories.
Click to hide internal directories.