A dnstwister alternative with screenshots, AI verdicts, and campaign detection

dnstwister is a genuinely useful service: free instant lookalike scans in the browser, low-cost monitoring, and a track record going back to 2015. If your question is "which domains similar to mine exist," it answers it. VigilDNS exists for the next questions: what is running on those domains, is it a clone of my site, who is behind it, and is my team seeing it in time to act.

What dnstwister does well

dnstwister was founded in late 2015 by Robert Wallhead as a web front end for Marcin Ulikowski's dnstwist permutation algorithm, and it broadened the audience for that idea enormously. You can scan a domain for free with no email or credit card. Paid subscriptions, advertised from $4.99, add ongoing monitoring with alerts for changes such as new MX records, and the service states that it monitors over a billion existing SSL certificates plus millions of newly registered certificates daily. Over the years it has added MX record lookups, RSS and Atom alert feeds, and a RESTful alerts API for subscribers. It is simple, affordable, and trusted by businesses across many industries, and for a solo founder watching one domain on a small budget it is a reasonable choice.

Where the comparison gets interesting: depth of evidence

Knowing a lookalike domain exists is step one. Deciding what to do about it requires evidence, and that is where the two services diverge. When VigilDNS finds a suspicious domain, it does not stop at the DNS records:

• Live page screenshots with clone detection. VigilDNS renders the page and shows it side by side with your real site, so you can see a cloned login page rather than infer one from an A record.
• AI threat verdicts. Each domain gets a judged intent (phishing, malware, parking, redirect, legitimate) with a confidence level and a written rationale, on top of a 0-100 risk score. You triage a ranked list, not a raw dump.
• Live Certificate Transparency streaming. VigilDNS watches CT logs continuously and catches a lookalike the moment a certificate is issued, which is frequently before the phishing page goes live. See how CT monitoring works.
• Campaign detection. Domains run by the same actor are clustered automatically via shared certificates, analytics IDs, and redirect targets, so 14 related domains show up as one campaign instead of 14 alerts.
• Dormant threat detection. Domains that are registered but serve no DNS are flagged and verified against the registry, catching infrastructure that is staged but not yet active.
• Full DNS depth. Every record type (A, AAAA, MX, NS, CNAME, SPF, DMARC, DKIM, TXT) with change history, plus RDAP registration data and ASN/geo attribution.
• Team workspaces. Roles, shared visibility, and 3 to 25 seats depending on plan, so monitoring is not locked to one inbox.

If a lookalike of your domain has already appeared, our guide on what to do when someone registers a lookalike of your domain walks through the response, and the evidence VigilDNS collects (screenshots, DNS history, RDAP data) is exactly what abuse desks ask for. To be fair to both sides of this comparison: neither service files takedowns for you, and VigilDNS does not monitor social media, the dark web, or app stores.

dnstwister vs VigilDNS at a glance

Where a cell says "not published," dnstwister's public materials do not document the capability; check their site for current details.

When dnstwister is the better fit

• Minimal budget. If $79/mo is out of reach, dnstwister's low-cost plans plus its free scanner are far better than no monitoring at all.
• One domain, one inbox. A solo operator who just wants an email when a similar domain appears does not need verdicts, screenshots, or seats.
• You only want existence alerts. If your process is "tell me it exists, I will investigate by hand," dnstwister covers that simply and reliably.

If you are weighing the open-source route instead, see our dnstwist comparison; for full digital risk protection suites with takedown services, see BrandShield and Red Points.

Frequently asked questions

Is dnstwister free?

The instant scan is free with no email or credit card required. Ongoing monitoring with alerts is a paid subscription, advertised from $4.99. VigilDNS likewise offers a free instant scan, with monitoring plans from $79/mo.

What is the difference between dnstwist and dnstwister?

dnstwist is the open-source command-line tool by Marcin Ulikowski. dnstwister is an independent web service, founded by Robert Wallhead in 2015, that originally wrapped the dnstwist algorithm and added hosted scans and email alerts.

Does dnstwister show screenshots of suspicious pages?

Page screenshots are not part of dnstwister's published feature set. VigilDNS captures live screenshots on every scan and runs side-by-side clone detection against your real site.

Why pay $79 when dnstwister starts at $4.99?

You are paying for triage depth: AI verdicts with written rationale, screenshots and clone detection, live CT log streaming, campaign clustering, dormant threat detection, full DNS change history, and team seats. If alert volume is low and you investigate by hand, dnstwister may be all you need.

See the difference on your own domain: run the free typosquat checker, then compare plans on the pricing page. Annual billing includes 2 months free.