$ show atenreiro/opensquat
openSquat is a CLI tool for detecting domain squatting threats including phishing, typosquatting, IDN homograph attacks, doppelgänger domains, and bitsquatting. It operates in three modes: Community (free NRD feed), Premium Feed (paid NRD feed with local Levenshtein detection), and Premium API (server-side lookalike API queries). The tool processes keywords against domain feeds using optimized Levenshtein distance with early exit, integrates with VirusTotal, Quad9 DNS, Certificate Transparency, and phishing databases, and outputs results in TXT, JSON, or CSV formats. Architecture features modular components for feed management, DNS validation, squatting detection, API client, and output handling, with parallel processing for performance.
The LLM identified 3 files worth highlighting for reuse:
Implements Levenshtein distance with early exit optimizations: skips computation when length difference exceeds threshold and stops mid-computation when no better result is possible. This isolated function is reusable in any project needing efficient string similarity checks.
Provides two functions: `check_homograph` to detect dangerous homoglyphs in a domain and `homograph_to_latin` to convert homoglyph domains to ASCII. Uses external libraries but is self-contained and reusable for IDN homograph detection in any cybersecurity or data processing context.
A robust client for the openSquat lookalike API. Features include connection pooling via requests.Session, thread-safe design, specific exception types for different error conditions (auth, plan, quota, rate limit), and proper handling of optional fields in responses. Demonstrates good practices for API client development and can be extracted for use with similar REST APIs.