← All cheat sheets

🌶 URLCRAZY

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

URLCrazy generates and tests domain typos and variations to detect
typosquatting, URL hijacking, and phishing domains. It tests
character omission, insertion, transposition, and other common
typing mistakes.

urlcrazy <domain>                # Generate typo variations
urlcrazy -r <domain>             # Resolve DNS for all variants

urlcrazy <domain>                # Target domain
urlcrazy -k <layout>             # Keyboard layout (qwerty, azerty, etc.)
urlcrazy -p                      # Show popularity estimate
urlcrazy -r                      # Resolve DNS for all domains
urlcrazy -i <file>               # Read domains from file
urlcrazy -o <file>               # Output to CSV file
urlcrazy -f <format>             # Output format (csv, human)
urlcrazy -n                      # Do not colorize output

urlcrazy -k qwerty <domain>      # QWERTY (US English, default)
urlcrazy -k azerty <domain>      # AZERTY (French)
urlcrazy -k qwertz <domain>      # QWERTZ (German)
urlcrazy -k dvorak <domain>      # Dvorak

# Character Omission:    exmple.com (missing 'a')
# Character Repeat:      exaample.com (double 'a')
# Adjacent Char Replace: ezample.com (z near a on keyboard)
# Character Transposition: exmaple.com (m and a swapped)
# Missing Dot:           wwwexample.com
# Strip Dashes:          ex-ample.com → example.com
# Character Insertion:   exaample.com
# Wrong TLD:             example.co, example.net, example.org
# Homoglyphs:            examp1e.com (1 looks like l)
# Vowel Swap:            exomple.com
# Homophones:            example.com → egzample.com
# Bit Flipping:          dxample.com
# Wrong SLD:             example.cm (common TLD typo)

# Basic typo generation
urlcrazy example.com

# Generate with DNS resolution
urlcrazy -r example.com

# French keyboard layout
urlcrazy -k azerty example.com

# Save results to CSV
urlcrazy -r -o results.csv example.com

# Check with popularity data
urlcrazy -r -p example.com

# Non-colored output for piping
urlcrazy -n -r example.com | grep "A:"

# Columns:
# Typo Type    - Category of typo (omission, repeat, etc.)
# Typo         - The typo domain name
# DNS-A        - Resolved IP address (if -r flag)
# CC           - Country code (if resolved)
# DNS-MX       - Mail server (if resolved)
#
# Registered domains with different IPs = potential threats
# MX records on typo domains = potential phishing

# 1. Brand Protection
# - Identify squatted domains impersonating your brand
# - Register defensive domains

# 2. Phishing Detection
# - Find domains used for phishing campaigns
# - Monitor new registrations of typo domains

# 3. Penetration Testing
# - Identify domains that could be used in social engineering
# - Register typo domains for authorized phishing tests

# 4. Competitive Intelligence
# - Check if competitors have registered typo variants

- Ruby-based tool
- DNS resolution adds time but is valuable
- Large domains generate many variations
- Some resolved domains may be parked, not malicious
- Check WHOIS on suspicious registered typo domains
- Pair with phishing awareness training
- Consider dnstwist as a modern alternative