openSquat Core

---

📑 Table of Contents

• What is openSquat?
• Open-Core Model
• Key Features
• Quick Start
• Requirements
• Usage
• Configuration
• Automation
• CLI Reference
• Contributing
• Author
• License

---

🎯 What is openSquat?

openSquat is an Open Source Intelligence (OSINT) security tool that identifies cyber squatting threats targeting your brand or domains:

Threat Type	Description
🎣 Phishing	Fraudulent domains mimicking your brand
🔤 Typosquatting	Domains with common typos (e.g., gooogle.com)
🌐 IDN Homograph	Look-alike characters from other alphabets
👥 Doppelgänger	Domains containing your brand name
🔀 Bitsquatting	Single-bit errors in domain names

🔓 Open-Core Model

openSquat follows an open-core model:

• Core detection engine — Open source and community-driven
• Advanced capabilities — Delivered through commercial intelligence services

This model enables transparency and community collaboration while supporting the scale, reliability, and operational requirements of enterprise use.

---

✨ Key Features

• 📅 Daily NRD feeds — Automatic newly registered domain updates
• 🔍 Similarity detection — Levenshtein distance algorithm
• 🛡️ VirusTotal integration — Check domain reputation
• 🌐 Quad9 DNS validation — Identify malicious domains
• 📜 Certificate Transparency — Monitor SSL/TLS certificates
• 📊 Multiple output formats — TXT, JSON, CSV

---

🚀 Quick Start

Install via pip (recommended)

pip install opensquat
opensquat -k keywords.txt

Or clone the repository

git clone https://github.com/atenreiro/opensquat
cd opensquat
pip install -r requirements.txt
python opensquat.py -k keywords.txt

---

📦 Requirements

• Python 3.8+
• Dependencies: confusable_homoglyphs, homoglyphs, colorama, requests, dnspython, beautifulsoup4

---

📖 Usage

Basic Commands

# Default run
opensquat

# Show all options
opensquat -h

# Use custom keywords file
opensquat -k my_keywords.txt

Validation Options

# DNS validation via Quad9
opensquat --dns

# Check Certificate Transparency logs
opensquat --ct

# Scan for open ports (80/443)
opensquat --portcheck

# Cross-reference phishing databases
opensquat --phishing results.txt

Output Formats

# Save as JSON
opensquat -o results.json -t json

# Save as CSV
opensquat -o results.csv -t csv

Confidence Levels

Level	Flag	Description
0	-c 0	Very high (fewer results, high accuracy)
1	-c 1	High (default)
2	-c 2	Medium
3	-c 3	Low
4	-c 4	Very low (more results, more false positives)

---

⚙️ Configuration

Keywords File (keywords.txt)

# Lines starting with # are comments
mycompany
mybrand
myproduct

VirusTotal API Key (vt_key.txt)

To use --vt or --subdomains, add your API key:

# Get your free API key at https://www.virustotal.com
your_api_key_here

---

🤖 Automation

Run daily via crontab:

# Every day at 8 AM (feeds update ~7:30 AM UTC)
0 8 * * * /path/to/opensquat/opensquat.py -k keywords.txt -o results.json -t json

---

📋 CLI Reference

Argument	Default	Description
-k, --keywords	keywords.txt	Keywords file to search
-o, --output	results.txt	Output filename
-t, --type	txt	Output format: txt, json, csv
-c, --confidence	1	Confidence level (0-4)
-d, --domains	—	Use local domain file instead of downloading
-u, --url	opensquat feed	URL to download domain feed
--dns	—	Enable Quad9 DNS validation
--doppelganger	—	Doppelganger-only mode (keyword in domain + reachability check)
--ct	—	Search Certificate Transparency logs
--phishing	—	Cross-reference phishing database
--subdomains	—	Fetch subdomains via VirusTotal
--portcheck	—	Check for open ports 80/443
--vt	—	Validate against VirusTotal

---

🤝 Contributing

We welcome contributions! See our Contributing Guide for details.

• 🐛 Report bugs via GitHub Issues
• 💡 Request features by opening an issue
• 🔧 Submit PRs for bug fixes or enhancements

---

👤 Author

Andre Tenreiro — LinkedIn · PGP Key

---

📜 License

This project is licensed under the GNU GPL v3.