Anthropic-Cybersecurity-Skills 实战使用 DNSTwist 检测、分析与持续监控 Typosquatting 仿冒域名【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本指南基于 Anthropic-Cybersecurity-Skills 仓库中的analyzing-typosquatting-domains-with-dnstwist技能文档系统讲解如何利用 DNSTwist 生成域名排列、解析 DNS 记录、以模糊哈希与感知哈希识别仿冒页面并落地为可自动化的风险评分与持续监控流水线。读完本文你将掌握从单次扫描、威胁分级、脚本化监控到封锁名单导出与下线takedown报告生成的完整实战方案并能对照仓库内的脚本与参考文档理解其底层实现。技能定位何时使用本技能analyzing-typosquatting-domains-with-dnstwist是仓库中 threat-intelligence威胁情报子领域下的一个结构化技能专用于应对品牌仿冒与钓鱼域名威胁。根据 SKILL.md 中声明的触发条件在以下场景应激活本技能调查涉及 typosquatting 域名的安全事件需要系统化分析可疑域名为该类威胁构建检测规则或威胁狩猎查询SOC 分析师需要针对此类分析的结构化操作流程验证针对相关攻击技术的安全监控覆盖是否充分。该技能在其 YAML frontmatter 中映射了多套行业框架方便 AI Agent 与安全团队进行合规对齐框架映射项含义MITRE ATTCKT1583.001 / T1583.006 / T1566.002 / T1598.003获取基础设施域名、鱼叉式钓鱼链接、钓鱼信息收集NIST CSF 2.0ID.RA-01 / ID.RA-05 / DE.CM-01 / DE.AE-02风险识别、持续监控、异常事件分析MITRE ATLASAML.T0073 / AML.T0052AI/ML 场景下的对抗性威胁活动MITRE F3 (v1.1)F1020.002伪造虚假网站等资源开发、侦察、初始访问阶段的欺诈技术F3 映射中还明确了该技能覆盖的战术阶段resource-developmentT1583.001 获取域名基础设施、F1020.002 创建虚假网站、reconnaissanceT1598 钓鱼信息收集、T1593 搜索公开网站/域名与 initial-accessT1660 钓鱼。这意味着 typosquatting 监测不仅是防御动作也直接对应攻击者完整的攻击链起点。仓库的 ATTACK_COVERAGE.md 与 mappings/mitre-attack/README.md 提供了全仓库的 ATTCK 覆盖视图可据此将本技能纳入整体的威胁知情防御规划。前置条件Python 3.9并安装 DNSTwistpip install dnstwist[full]完整安装包含 ssdeep、pHash 等可选依赖可选GeoIP 数据库用于 IP 地理位置标注可选Shodan API Key用于结果情报增强可访问公网的网络环境以执行 DNS 查询理解 DNS 记录类型A、AAAA、NS、MX与域名注册基础知识。核心概念域名排列Permutation技术DNSTwist 本质是一个域名排列引擎它会针对目标域名批量生成「看起来相似」的候选域名然后逐一探测这些域名是否已被注册、是否解析、以及页面是否仿冒合法站点。根据 SKILL.md 与 api-reference.md主要排列技术如下技术说明示例以 example.com 为例Addition追加在末尾追加字符examplea.comBitsquatting位翻转模拟 DNS 位翻转错误dxample.comHomoglyph同形字使用视觉相似的字符examp1e.com字母 l→数字 1Hyphenation加连字符插入连字符exam-ple.comInsertion插入在中间插入字符exaample.comOmission删减删除某个字符examle.comRepetition重复重复某个字符exxample.comReplacement替换替换为键盘相邻键rxample.come→rSubdomain子域名插入点号制造子域名ex.ample.comTransposition换位交换相邻字符exmaple.comVowel-swap元音互换替换元音exomple.comDictionary字典追加常见单词需配合词表如example-login.com模糊哈希与视觉相似度仿冒域名是否真正构成威胁关键看其页面是否克隆了合法站点。DNSTwist 使用两类哈希技术度量相似度ssdeep上下文分段哈希对页面 HTML 内容做局部敏感哈希locality-sensitive hash输出ssdeep_score0-100分数越高说明内容越接近合法页面pHash感知哈希对页面截图做感知哈希识别视觉上模仿合法站点的克隆页面。高相似度得分通常意味着该域名极可能是钓鱼页面是风险评分的核心输入之一。检测工作流典型工作流为生成域名排列 → 解析 DNS 记录 → 筛查已注册域名 → 比较页面相似度 → 标记可疑域名 → 告警安全团队 → 申请下线takedown。对于典型的企业域名DNSTwist 一次约生成 5,00010,000 个排列。实战工作流以下四个步骤完整对应 SKILL.md 的 Workflow 章节可直接复制运行。Step 1基础域名排列扫描import subprocess import json import csv from datetime import datetime def run_dnstwist_scan(domain, output_fileNone): Run dnstwist scan against a target domain. cmd [ dnstwist, --registered, # Only show registered domains --format, json, # Output in JSON --nameservers, 8.8.8.8,1.1.1.1, --threads, 50, --mxcheck, # Check MX records --ssdeep, # Fuzzy hash comparison --geoip, # GeoIP lookup domain, ] print(f[*] Scanning permutations for: {domain}) result subprocess.run(cmd, capture_outputTrue, textTrue, timeout600) if result.returncode 0: results json.loads(result.stdout) registered [r for r in results if r.get(dns_a) or r.get(dns_aaaa)] print(f[] Found {len(registered)} registered lookalike domains) if output_file: with open(output_file, w) as f: json.dump(registered, f, indent2) print(f[] Results saved to {output_file}) return registered else: print(f[-] dnstwist error: {result.stderr}) return [] results run_dnstwist_scan(example.com, typosquat_results.json)命令行参数说明来自 api-reference.md 的 CLI 语法速查dnstwist example.com # 基础扫描 dnstwist -r example.com # 解析 DNS 记录 dnstwist -r -f json example.com # JSON 输出 dnstwist -r -f csv example.com # CSV 输出 dnstwist -r --ssdeep example.com # 启用模糊哈希对比 dnstwist -r --phash example.com # 启用感知哈希截图对比 dnstwist -r -w wordlist.txt example.com # 基于字典的排列 dnstwist --nameservers 8.8.8.8 example.com # 自定义 DNS 服务器JSON 输出中的核心字段含义如下它们是后续风险评分脚本的输入字段说明fuzzer生成该域名所用的排列技术domain排列生成的域名dns_aA 记录 IP 地址列表dns_aaaaAAAA 记录地址列表dns_mx邮件服务器记录dns_ns权威名称服务器记录geoipGeoIP 定位的国家whois_registrar域名注册商ssdeep_score模糊哈希相似度0-100Step 2结果分析与威胁分级扫描结果往往包含大量误报如注册后被正常转售、用于品牌保护的域名。需要结合多个信号计算风险分并排序def analyze_results(results, legitimate_ipsNone): Analyze dnstwist results and prioritize threats. legitimate_ips legitimate_ips or set() high_risk [] medium_risk [] low_risk [] for entry in results: domain entry.get(domain, ) fuzzer entry.get(fuzzer, ) dns_a entry.get(dns_a, []) dns_mx entry.get(dns_mx, []) ssdeep_score entry.get(ssdeep_score, 0) risk_score 0 risk_factors [] # High similarity to legitimate site if ssdeep_score and ssdeep_score 50: risk_score 40 risk_factors.append(fhigh web similarity ({ssdeep_score}%)) # Has MX records (can receive email / phishing) if dns_mx: risk_score 20 risk_factors.append(has MX records (email capable)) # Recently registered (if whois data available) whois_created entry.get(whois_created, ) if whois_created: try: created datetime.fromisoformat(whois_created.replace(Z, 00:00)) age_days (datetime.now(created.tzinfo) - created).days if age_days 30: risk_score 30 risk_factors.append(frecently registered ({age_days} days)) elif age_days 90: risk_score 15 risk_factors.append(fregistered {age_days} days ago) except (ValueError, TypeError): pass # Homoglyph attacks are highest risk if fuzzer homoglyph: risk_score 25 risk_factors.append(homoglyph (visually identical)) elif fuzzer in (addition, replacement, transposition): risk_score 10 risk_factors.append(fpermutation type: {fuzzer}) # Not pointing to legitimate infrastructure if dns_a and not set(dns_a).intersection(legitimate_ips): risk_score 10 risk_factors.append(different IP from legitimate) entry[risk_score] risk_score entry[risk_factors] risk_factors if risk_score 50: high_risk.append(entry) elif risk_score 25: medium_risk.append(entry) else: low_risk.append(entry) high_risk.sort(keylambda x: x[risk_score], reverseTrue) medium_risk.sort(keylambda x: x[risk_score], reverseTrue) print(f\n Typosquatting Analysis ) print(fHigh Risk: {len(high_risk)}) print(fMedium Risk: {len(medium_risk)}) print(fLow Risk: {len(low_risk)}) if high_risk: print(f\n--- High Risk Domains ---) for entry in high_risk[:10]: print(f {entry[domain]} (score: {entry[risk_score]})) for factor in entry[risk_factors]: print(f - {factor}) return {high: high_risk, medium: medium_risk, low: low_risk} analysis analyze_results(results, legitimate_ips{93.184.216.34})评分逻辑要点页面相似度 50 是强信号40具备 MX 记录意味着可接收邮件、具备钓鱼能力20注册时间不足 30 天表明刚被恶意注册30同形字homoglyph排列视觉上几乎无法区分风险最高25解析 IP 与合法基础设施不一致10。总分 ≥ 50 为高危≥ 25 为中危。Step 3持续监控流水线typosquatting 威胁是动态的——攻击者随时可能注册新的仿冒域名。将扫描封装为可定期执行的监控类维护一个已知域名档案即可实现增量检测import time import hashlib class TyposquatMonitor: def __init__(self, domains, known_domains_fileknown_typosquats.json): self.domains domains self.known_file known_domains_file self.known_domains self._load_known() def _load_known(self): try: with open(self.known_file, r) as f: return json.load(f) except FileNotFoundError: return {} def _save_known(self): with open(self.known_file, w) as f: json.dump(self.known_domains, f, indent2) def scan_all_domains(self): Scan all monitored domains for new typosquats. new_findings [] for domain in self.domains: results run_dnstwist_scan(domain) for entry in results: domain_key entry.get(domain, ) if domain_key not in self.known_domains: entry[first_seen] datetime.now().isoformat() entry[monitored_domain] domain self.known_domains[domain_key] entry new_findings.append(entry) print(f [NEW] {domain_key} ({entry.get(fuzzer, )})) self._save_known() print(f\n[] New typosquatting domains found: {len(new_findings)}) return new_findings def generate_alert(self, findings): Generate alert for new high-risk typosquatting domains. analysis analyze_results(findings) alerts [] for entry in analysis[high]: alerts.append({ severity: HIGH, domain: entry[domain], target: entry.get(monitored_domain, ), risk_score: entry[risk_score], risk_factors: entry[risk_factors], dns_a: entry.get(dns_a, []), dns_mx: entry.get(dns_mx, []), timestamp: datetime.now().isoformat(), }) return alerts monitor TyposquatMonitor([mycompany.com, mycompany.org]) new_findings monitor.scan_all_domains() alerts monitor.generate_alert(new_findings)该类的设计可直接挂接定时任务cron / CI scheduled job每次运行只报告「新出现」的域名并将first_seen时间戳落盘既降低告警噪音也为后续调查保留时间线证据。Step 4封锁名单导出与下线Takedown报告对确认的高危域名应尽快写入防火墙/代理封锁名单并生成结构化下线申请材料def export_blocklist(analysis, output_fileblocklist.txt): Export high-risk domains as blocklist for firewall/proxy. domains [] for entry in analysis[high] analysis[medium]: domain entry.get(domain, ) if domain: domains.append(domain) with open(output_file, w) as f: f.write(f# Typosquatting blocklist generated {datetime.now().isoformat()}\n) for d in sorted(set(domains)): f.write(f{d}\n) print(f[] Blocklist saved: {len(domains)} domains - {output_file}) return domains def generate_takedown_report(high_risk_domains): Generate takedown request report. report f# Domain Takedown Request Generated: {datetime.now().isoformat()} ## Summary {len(high_risk_domains)} domains identified as potential typosquatting/phishing. ## Domains Requiring Takedown for entry in high_risk_domains: report f ### {entry[domain]} - **Permutation Type**: {entry.get(fuzzer, unknown)} - **IP Address**: {, .join(entry.get(dns_a, [N/A]))} - **MX Records**: {, .join(entry.get(dns_mx, [N/A]))} - **Risk Score**: {entry.get(risk_score, 0)} - **Risk Factors**: {; .join(entry.get(risk_factors, []))} - **Web Similarity**: {entry.get(ssdeep_score, N/A)}% with open(takedown_report.md, w) as f: f.write(report) print([] Takedown report generated: takedown_report.md) export_blocklist(analysis) generate_takedown_report(analysis[high])下线报告应包含排列类型、解析 IP、MX 记录、风险分、风险因素与页面相似度等字段这些正是注册商与域名仲裁机构判断「恶意注册」所需的核心证据。补充调查与情报增强api-reference.md 还提供了两条可选的深度调查路径WHOIS 查询确认可疑域名的注册时间与注册商辅助判断是否为刚注册的恶意域名import whois w whois.whois(suspicious-domain.com) print(w.creation_date, w.registrar)VirusTotal 域名检查将高危域名提交到 VirusTotal 关联分析需替换为你的 API Keycurl -H x-apikey: KEY \ https://www.virustotal.com/api/v3/domains/domain源码级原理仓库脚本如何印证检测逻辑仓库为本技能提供了可独立运行的参考实现 scripts/agent.py其中以纯 Python 复现了 SKILL.md 的核心检测逻辑可作为理解 DNSTwist 原理的最小实现排列生成generate_permutations()函数实现了删减omission、换位transposition、键盘邻居替换replacement、同形字替换homoglyph与连字符插入hyphenation五类排列。其中的键盘邻居表KEYBOARD_NEIGHBORS直接编码了 QWERTY 布局的相邻键关系如e: wrds而同形字映射表{o: 0, l: 1, i: 1, s: 5, a: 4, e: 3}与 SKILL.md 中「homoglyph 视觉同形」的表述一一对应DNS 解析resolve_domain()基于socket.getaddrinfo解析 A 记录无解析结果的候选域名会被丢弃——这印证了 Step 1 中「以dns_a是否非空判定已注册域名」的筛选逻辑双模式运行脚本优先调用真实dnstwistCLIrun_dnstwist_cli()即dnstwist -r -f json不可用时回退到内置纯 Python 实现并在最后按活跃仿冒域名数量输出 HIGH/MEDIUM/LOW 三级风险结论。运行方式python skills/analyzing-typosquatting-domains-with-dnstwist/scripts/agent.py example.com验证标准Validation Criteria对照 SKILL.md 的验证清单确认整套流程落地成功DNSTwist 成功为目标域名生成排列DNS 解析正确识别已注册的仿冒域名网页相似度评分能够识别克隆钓鱼页面风险评分能按威胁等级对域名排序持续监控可检测到新注册的 typosquat 域名封锁名单与下线报告生成正确。延伸阅读技能定义与完整工作流SKILL.mdCLI 语法、输出字段与 Python 集成速查api-reference.md可运行的参考实现scripts/agent.py本技能在仓库框架映射中的位置mappings/mitre-attack/README.md、mappings/nist-csf/README.md、ATTACK_COVERAGE.md【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
Anthropic-Cybersecurity-Skills 实战：使用 DNSTwist 检测、分析与持续监控 Typosquatting 仿冒域名
Anthropic-Cybersecurity-Skills 实战使用 DNSTwist 检测、分析与持续监控 Typosquatting 仿冒域名【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本指南基于 Anthropic-Cybersecurity-Skills 仓库中的analyzing-typosquatting-domains-with-dnstwist技能文档系统讲解如何利用 DNSTwist 生成域名排列、解析 DNS 记录、以模糊哈希与感知哈希识别仿冒页面并落地为可自动化的风险评分与持续监控流水线。读完本文你将掌握从单次扫描、威胁分级、脚本化监控到封锁名单导出与下线takedown报告生成的完整实战方案并能对照仓库内的脚本与参考文档理解其底层实现。技能定位何时使用本技能analyzing-typosquatting-domains-with-dnstwist是仓库中 threat-intelligence威胁情报子领域下的一个结构化技能专用于应对品牌仿冒与钓鱼域名威胁。根据 SKILL.md 中声明的触发条件在以下场景应激活本技能调查涉及 typosquatting 域名的安全事件需要系统化分析可疑域名为该类威胁构建检测规则或威胁狩猎查询SOC 分析师需要针对此类分析的结构化操作流程验证针对相关攻击技术的安全监控覆盖是否充分。该技能在其 YAML frontmatter 中映射了多套行业框架方便 AI Agent 与安全团队进行合规对齐框架映射项含义MITRE ATTCKT1583.001 / T1583.006 / T1566.002 / T1598.003获取基础设施域名、鱼叉式钓鱼链接、钓鱼信息收集NIST CSF 2.0ID.RA-01 / ID.RA-05 / DE.CM-01 / DE.AE-02风险识别、持续监控、异常事件分析MITRE ATLASAML.T0073 / AML.T0052AI/ML 场景下的对抗性威胁活动MITRE F3 (v1.1)F1020.002伪造虚假网站等资源开发、侦察、初始访问阶段的欺诈技术F3 映射中还明确了该技能覆盖的战术阶段resource-developmentT1583.001 获取域名基础设施、F1020.002 创建虚假网站、reconnaissanceT1598 钓鱼信息收集、T1593 搜索公开网站/域名与 initial-accessT1660 钓鱼。这意味着 typosquatting 监测不仅是防御动作也直接对应攻击者完整的攻击链起点。仓库的 ATTACK_COVERAGE.md 与 mappings/mitre-attack/README.md 提供了全仓库的 ATTCK 覆盖视图可据此将本技能纳入整体的威胁知情防御规划。前置条件Python 3.9并安装 DNSTwistpip install dnstwist[full]完整安装包含 ssdeep、pHash 等可选依赖可选GeoIP 数据库用于 IP 地理位置标注可选Shodan API Key用于结果情报增强可访问公网的网络环境以执行 DNS 查询理解 DNS 记录类型A、AAAA、NS、MX与域名注册基础知识。核心概念域名排列Permutation技术DNSTwist 本质是一个域名排列引擎它会针对目标域名批量生成「看起来相似」的候选域名然后逐一探测这些域名是否已被注册、是否解析、以及页面是否仿冒合法站点。根据 SKILL.md 与 api-reference.md主要排列技术如下技术说明示例以 example.com 为例Addition追加在末尾追加字符examplea.comBitsquatting位翻转模拟 DNS 位翻转错误dxample.comHomoglyph同形字使用视觉相似的字符examp1e.com字母 l→数字 1Hyphenation加连字符插入连字符exam-ple.comInsertion插入在中间插入字符exaample.comOmission删减删除某个字符examle.comRepetition重复重复某个字符exxample.comReplacement替换替换为键盘相邻键rxample.come→rSubdomain子域名插入点号制造子域名ex.ample.comTransposition换位交换相邻字符exmaple.comVowel-swap元音互换替换元音exomple.comDictionary字典追加常见单词需配合词表如example-login.com模糊哈希与视觉相似度仿冒域名是否真正构成威胁关键看其页面是否克隆了合法站点。DNSTwist 使用两类哈希技术度量相似度ssdeep上下文分段哈希对页面 HTML 内容做局部敏感哈希locality-sensitive hash输出ssdeep_score0-100分数越高说明内容越接近合法页面pHash感知哈希对页面截图做感知哈希识别视觉上模仿合法站点的克隆页面。高相似度得分通常意味着该域名极可能是钓鱼页面是风险评分的核心输入之一。检测工作流典型工作流为生成域名排列 → 解析 DNS 记录 → 筛查已注册域名 → 比较页面相似度 → 标记可疑域名 → 告警安全团队 → 申请下线takedown。对于典型的企业域名DNSTwist 一次约生成 5,00010,000 个排列。实战工作流以下四个步骤完整对应 SKILL.md 的 Workflow 章节可直接复制运行。Step 1基础域名排列扫描import subprocess import json import csv from datetime import datetime def run_dnstwist_scan(domain, output_fileNone): Run dnstwist scan against a target domain. cmd [ dnstwist, --registered, # Only show registered domains --format, json, # Output in JSON --nameservers, 8.8.8.8,1.1.1.1, --threads, 50, --mxcheck, # Check MX records --ssdeep, # Fuzzy hash comparison --geoip, # GeoIP lookup domain, ] print(f[*] Scanning permutations for: {domain}) result subprocess.run(cmd, capture_outputTrue, textTrue, timeout600) if result.returncode 0: results json.loads(result.stdout) registered [r for r in results if r.get(dns_a) or r.get(dns_aaaa)] print(f[] Found {len(registered)} registered lookalike domains) if output_file: with open(output_file, w) as f: json.dump(registered, f, indent2) print(f[] Results saved to {output_file}) return registered else: print(f[-] dnstwist error: {result.stderr}) return [] results run_dnstwist_scan(example.com, typosquat_results.json)命令行参数说明来自 api-reference.md 的 CLI 语法速查dnstwist example.com # 基础扫描 dnstwist -r example.com # 解析 DNS 记录 dnstwist -r -f json example.com # JSON 输出 dnstwist -r -f csv example.com # CSV 输出 dnstwist -r --ssdeep example.com # 启用模糊哈希对比 dnstwist -r --phash example.com # 启用感知哈希截图对比 dnstwist -r -w wordlist.txt example.com # 基于字典的排列 dnstwist --nameservers 8.8.8.8 example.com # 自定义 DNS 服务器JSON 输出中的核心字段含义如下它们是后续风险评分脚本的输入字段说明fuzzer生成该域名所用的排列技术domain排列生成的域名dns_aA 记录 IP 地址列表dns_aaaaAAAA 记录地址列表dns_mx邮件服务器记录dns_ns权威名称服务器记录geoipGeoIP 定位的国家whois_registrar域名注册商ssdeep_score模糊哈希相似度0-100Step 2结果分析与威胁分级扫描结果往往包含大量误报如注册后被正常转售、用于品牌保护的域名。需要结合多个信号计算风险分并排序def analyze_results(results, legitimate_ipsNone): Analyze dnstwist results and prioritize threats. legitimate_ips legitimate_ips or set() high_risk [] medium_risk [] low_risk [] for entry in results: domain entry.get(domain, ) fuzzer entry.get(fuzzer, ) dns_a entry.get(dns_a, []) dns_mx entry.get(dns_mx, []) ssdeep_score entry.get(ssdeep_score, 0) risk_score 0 risk_factors [] # High similarity to legitimate site if ssdeep_score and ssdeep_score 50: risk_score 40 risk_factors.append(fhigh web similarity ({ssdeep_score}%)) # Has MX records (can receive email / phishing) if dns_mx: risk_score 20 risk_factors.append(has MX records (email capable)) # Recently registered (if whois data available) whois_created entry.get(whois_created, ) if whois_created: try: created datetime.fromisoformat(whois_created.replace(Z, 00:00)) age_days (datetime.now(created.tzinfo) - created).days if age_days 30: risk_score 30 risk_factors.append(frecently registered ({age_days} days)) elif age_days 90: risk_score 15 risk_factors.append(fregistered {age_days} days ago) except (ValueError, TypeError): pass # Homoglyph attacks are highest risk if fuzzer homoglyph: risk_score 25 risk_factors.append(homoglyph (visually identical)) elif fuzzer in (addition, replacement, transposition): risk_score 10 risk_factors.append(fpermutation type: {fuzzer}) # Not pointing to legitimate infrastructure if dns_a and not set(dns_a).intersection(legitimate_ips): risk_score 10 risk_factors.append(different IP from legitimate) entry[risk_score] risk_score entry[risk_factors] risk_factors if risk_score 50: high_risk.append(entry) elif risk_score 25: medium_risk.append(entry) else: low_risk.append(entry) high_risk.sort(keylambda x: x[risk_score], reverseTrue) medium_risk.sort(keylambda x: x[risk_score], reverseTrue) print(f\n Typosquatting Analysis ) print(fHigh Risk: {len(high_risk)}) print(fMedium Risk: {len(medium_risk)}) print(fLow Risk: {len(low_risk)}) if high_risk: print(f\n--- High Risk Domains ---) for entry in high_risk[:10]: print(f {entry[domain]} (score: {entry[risk_score]})) for factor in entry[risk_factors]: print(f - {factor}) return {high: high_risk, medium: medium_risk, low: low_risk} analysis analyze_results(results, legitimate_ips{93.184.216.34})评分逻辑要点页面相似度 50 是强信号40具备 MX 记录意味着可接收邮件、具备钓鱼能力20注册时间不足 30 天表明刚被恶意注册30同形字homoglyph排列视觉上几乎无法区分风险最高25解析 IP 与合法基础设施不一致10。总分 ≥ 50 为高危≥ 25 为中危。Step 3持续监控流水线typosquatting 威胁是动态的——攻击者随时可能注册新的仿冒域名。将扫描封装为可定期执行的监控类维护一个已知域名档案即可实现增量检测import time import hashlib class TyposquatMonitor: def __init__(self, domains, known_domains_fileknown_typosquats.json): self.domains domains self.known_file known_domains_file self.known_domains self._load_known() def _load_known(self): try: with open(self.known_file, r) as f: return json.load(f) except FileNotFoundError: return {} def _save_known(self): with open(self.known_file, w) as f: json.dump(self.known_domains, f, indent2) def scan_all_domains(self): Scan all monitored domains for new typosquats. new_findings [] for domain in self.domains: results run_dnstwist_scan(domain) for entry in results: domain_key entry.get(domain, ) if domain_key not in self.known_domains: entry[first_seen] datetime.now().isoformat() entry[monitored_domain] domain self.known_domains[domain_key] entry new_findings.append(entry) print(f [NEW] {domain_key} ({entry.get(fuzzer, )})) self._save_known() print(f\n[] New typosquatting domains found: {len(new_findings)}) return new_findings def generate_alert(self, findings): Generate alert for new high-risk typosquatting domains. analysis analyze_results(findings) alerts [] for entry in analysis[high]: alerts.append({ severity: HIGH, domain: entry[domain], target: entry.get(monitored_domain, ), risk_score: entry[risk_score], risk_factors: entry[risk_factors], dns_a: entry.get(dns_a, []), dns_mx: entry.get(dns_mx, []), timestamp: datetime.now().isoformat(), }) return alerts monitor TyposquatMonitor([mycompany.com, mycompany.org]) new_findings monitor.scan_all_domains() alerts monitor.generate_alert(new_findings)该类的设计可直接挂接定时任务cron / CI scheduled job每次运行只报告「新出现」的域名并将first_seen时间戳落盘既降低告警噪音也为后续调查保留时间线证据。Step 4封锁名单导出与下线Takedown报告对确认的高危域名应尽快写入防火墙/代理封锁名单并生成结构化下线申请材料def export_blocklist(analysis, output_fileblocklist.txt): Export high-risk domains as blocklist for firewall/proxy. domains [] for entry in analysis[high] analysis[medium]: domain entry.get(domain, ) if domain: domains.append(domain) with open(output_file, w) as f: f.write(f# Typosquatting blocklist generated {datetime.now().isoformat()}\n) for d in sorted(set(domains)): f.write(f{d}\n) print(f[] Blocklist saved: {len(domains)} domains - {output_file}) return domains def generate_takedown_report(high_risk_domains): Generate takedown request report. report f# Domain Takedown Request Generated: {datetime.now().isoformat()} ## Summary {len(high_risk_domains)} domains identified as potential typosquatting/phishing. ## Domains Requiring Takedown for entry in high_risk_domains: report f ### {entry[domain]} - **Permutation Type**: {entry.get(fuzzer, unknown)} - **IP Address**: {, .join(entry.get(dns_a, [N/A]))} - **MX Records**: {, .join(entry.get(dns_mx, [N/A]))} - **Risk Score**: {entry.get(risk_score, 0)} - **Risk Factors**: {; .join(entry.get(risk_factors, []))} - **Web Similarity**: {entry.get(ssdeep_score, N/A)}% with open(takedown_report.md, w) as f: f.write(report) print([] Takedown report generated: takedown_report.md) export_blocklist(analysis) generate_takedown_report(analysis[high])下线报告应包含排列类型、解析 IP、MX 记录、风险分、风险因素与页面相似度等字段这些正是注册商与域名仲裁机构判断「恶意注册」所需的核心证据。补充调查与情报增强api-reference.md 还提供了两条可选的深度调查路径WHOIS 查询确认可疑域名的注册时间与注册商辅助判断是否为刚注册的恶意域名import whois w whois.whois(suspicious-domain.com) print(w.creation_date, w.registrar)VirusTotal 域名检查将高危域名提交到 VirusTotal 关联分析需替换为你的 API Keycurl -H x-apikey: KEY \ https://www.virustotal.com/api/v3/domains/domain源码级原理仓库脚本如何印证检测逻辑仓库为本技能提供了可独立运行的参考实现 scripts/agent.py其中以纯 Python 复现了 SKILL.md 的核心检测逻辑可作为理解 DNSTwist 原理的最小实现排列生成generate_permutations()函数实现了删减omission、换位transposition、键盘邻居替换replacement、同形字替换homoglyph与连字符插入hyphenation五类排列。其中的键盘邻居表KEYBOARD_NEIGHBORS直接编码了 QWERTY 布局的相邻键关系如e: wrds而同形字映射表{o: 0, l: 1, i: 1, s: 5, a: 4, e: 3}与 SKILL.md 中「homoglyph 视觉同形」的表述一一对应DNS 解析resolve_domain()基于socket.getaddrinfo解析 A 记录无解析结果的候选域名会被丢弃——这印证了 Step 1 中「以dns_a是否非空判定已注册域名」的筛选逻辑双模式运行脚本优先调用真实dnstwistCLIrun_dnstwist_cli()即dnstwist -r -f json不可用时回退到内置纯 Python 实现并在最后按活跃仿冒域名数量输出 HIGH/MEDIUM/LOW 三级风险结论。运行方式python skills/analyzing-typosquatting-domains-with-dnstwist/scripts/agent.py example.com验证标准Validation Criteria对照 SKILL.md 的验证清单确认整套流程落地成功DNSTwist 成功为目标域名生成排列DNS 解析正确识别已注册的仿冒域名网页相似度评分能够识别克隆钓鱼页面风险评分能按威胁等级对域名排序持续监控可检测到新注册的 typosquat 域名封锁名单与下线报告生成正确。延伸阅读技能定义与完整工作流SKILL.mdCLI 语法、输出字段与 Python 集成速查api-reference.md可运行的参考实现scripts/agent.py本技能在仓库框架映射中的位置mappings/mitre-attack/README.md、mappings/nist-csf/README.md、ATTACK_COVERAGE.md【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考
