Documentation and Issues for the domain search engine domains.ciko.io. This repository does not contain source code.
domains.ciko.io enables you to to find registered domain names that reassemble a given keyword. The results are useful to find phishing domains or shadow infrastructure. Instead of only scanning for the keyword, the tool also scans for deviations (also called squatting domains) that are similar to the given keyword.
- Enter a keyword in the search field on the domains.ciko.io. The keyword may only contain ASCII letters, numbers, and dashes. Enter an access token to validate the search. Press the find button.
- The tool generates a list of domains to scan, and then scans them. This may take up to 20 minutes, depending on the keyword and scan configuration. You may periodically reload the page to see newly found domains.
- You can click on any search result to get an overview of its DNS records and subdomains.
The tool is publicly usable but requires an access token that are consumed per scan. ciko distributes access token on various channels. If you need some access token out of sequence, please mail me at domains@ciko.io.
I issue access token to rate limit the usage of the tool and limit waiting times. DNS scanning and enriching are network-heavy and longer lasting tasks. I provide for the entire infrastructure out of private funds, so it cannot be scaled like a commercial product.
domains.ciko.io uses 3 engines to find squatting domains: Active DNS probing, scans of certificate transparency logs, and scans in TI datafeeds. All three engines are enabled by default. You can disable and configure the scan settings on the main page before starting the scan.
The tool is currently limited to 10,000 found domains and 100,000 DNS scans per keyword to limit network usage.
You may submit issues and requests via GitHub issues. You can also use domains@ciko.io for that purpose.
- This tool uses the permutation engine of dnstwist.
- Certificates for scanning are collected with certstream.