opensquat 2.3.0__tar.gz → 2.3.1__tar.gz

{opensquat-2.3.0 → opensquat-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opensquat
-Version: 2.3.0
+Version: 2.3.1
 Summary: openSquat - Detection of domain squatting, typosquatting, IDN homograph attacks, and phishing threats
 Author-email: Andre Tenreiro <andre@opensquat.com>
 License-Expression: GPL-3.0-only
@@ -36,7 +36,8 @@ Dynamic: license-file
 <h1 align="center">openSquat Core</h1>
 
 <p align="center">
-  <a href="#"><img src="https://img.shields.io/badge/python-3.10+-blue.svg" alt="Python 3.10+"></a>
+  <a href="https://pypi.org/project/opensquat/"><img src="https://img.shields.io/pypi/v/opensquat" alt="PyPI"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.10+-blue.svg" alt="Python 3.10+"></a>
   <a href="https://github.com/atenreiro/opensquat/blob/master/LICENSE"><img src="https://img.shields.io/badge/License-GPLv3-blue.svg" alt="License: GPL v3"></a>
   <a href="https://github.com/atenreiro/opensquat/issues"><img src="https://img.shields.io/github/issues/atenreiro/opensquat" alt="GitHub issues"></a>
   <a href="https://github.com/atenreiro/opensquat/stargazers"><img src="https://img.shields.io/github/stars/atenreiro/opensquat" alt="GitHub stars"></a>
@@ -54,6 +55,7 @@ Dynamic: license-file
 - [Requirements](#-requirements)
 - [Usage](#-usage)
 - [Premium and API Modes](#-premium-and-api-modes)
+- [MCP Server](#-mcp-server)
 - [Configuration](#%EF%B8%8F-configuration)
 - [Automation](#-automation)
 - [CLI Reference](#-cli-reference)
@@ -82,9 +84,6 @@ openSquat is an **Open Source Intelligence (OSINT)** security tool that identifi
 > **"A powerful swiss army knife for brand protection"**
 > — [WhoisXML API Blog](https://www.whoisxmlapi.com/blog/orchestrating-open-source-software-and-whois-newly-registered-domain-data-feeds-to-fight-the-typosquatting-plague), August 2022
 
-> **"A tool with insane power to fight typosquatting and all related types of cyber mischief."**
-> — [WhoisXML API Blog](https://www.whoisxmlapi.com/blog/orchestrating-open-source-software-and-whois-newly-registered-domain-data-feeds-to-fight-the-typosquatting-plague), August 2022
-
 > **"A handy tool for collecting information on newly registered domains."** — ranked Top 5 phishing detection tool
 > — [SOCRadar Blog](https://socradar.io/blog/top-5-tools-for-phishing-domain-detection/), July 2022
 
@@ -141,6 +140,12 @@ python3 opensquat.py -k keywords.txt
 
 > **Repo users:** in all the examples below, replace `opensquat` with `python3 opensquat.py` to run from a cloned checkout.
 
+### See it in action
+
+<p align="center">
+  <img src="screenshots/openSquat_v2.3.0.png" alt="openSquat 2.3.0 scanning the daily NRD feed for lookalikes of google, facebook, amazon and paypal" width="650"/>
+</p>
+
 ---
 
 ## 📦 Requirements
@@ -316,6 +321,21 @@ Premium API (`--api`) is incompatible with `--doppelganger` and `-d/--domains`.
 
 ---
 
+## 🔌 MCP Server
+
+openSquat is also available as a **Model Context Protocol (MCP) server**, so AI assistants and agents (Claude, and any other MCP-compatible client) can query lookalike-domain intelligence directly:
+
+| Tool | What it does | Quota cost |
+|------|--------------|------------|
+| `search_lookalike_domains` | Find newly registered domains impersonating a brand or keyword (phishing, brand abuse, typosquatting) | 1 query per search |
+| `validate_api_key` | Confirm the connection is authenticated | Free |
+
+Authentication uses the same openSquat account as the Premium modes: either sign in with OAuth, or supply your API key (`os_...`) via the `Authorization: Bearer` header (or `X-OpenSquat-Key`). Searches draw from the same plan quota as the Premium API.
+
+See [opensquat.com](https://opensquat.com) for the MCP endpoint and client setup instructions.
+
+---
+
 ## ⚙️ Configuration
 
 ### Keywords File (`keywords.txt`)
@@ -378,6 +398,7 @@ Run daily via crontab:
 | `--doppelganger` | — | Doppelganger-only mode (keyword in domain + reachability check) |
 | `--ct` | — | Search Certificate Transparency logs |
 | `--phishing` | — | Cross-reference phishing database |
+| `--phishing-fallback` | — | Optional `https` list of phishing domains/URLs, used only when the default database cannot be downloaded |
 | `--subdomains` | — | Fetch subdomains via VirusTotal |
 | `--portcheck` | — | Check for open ports 80/443 |
 | `--vt` | — | Validate against VirusTotal |

{opensquat-2.3.0 → opensquat-2.3.1}/README.md

@@ -5,7 +5,8 @@
 <h1 align="center">openSquat Core</h1>
 
 <p align="center">
-  <a href="#"><img src="https://img.shields.io/badge/python-3.10+-blue.svg" alt="Python 3.10+"></a>
+  <a href="https://pypi.org/project/opensquat/"><img src="https://img.shields.io/pypi/v/opensquat" alt="PyPI"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.10+-blue.svg" alt="Python 3.10+"></a>
   <a href="https://github.com/atenreiro/opensquat/blob/master/LICENSE"><img src="https://img.shields.io/badge/License-GPLv3-blue.svg" alt="License: GPL v3"></a>
   <a href="https://github.com/atenreiro/opensquat/issues"><img src="https://img.shields.io/github/issues/atenreiro/opensquat" alt="GitHub issues"></a>
   <a href="https://github.com/atenreiro/opensquat/stargazers"><img src="https://img.shields.io/github/stars/atenreiro/opensquat" alt="GitHub stars"></a>
@@ -23,6 +24,7 @@
 - [Requirements](#-requirements)
 - [Usage](#-usage)
 - [Premium and API Modes](#-premium-and-api-modes)
+- [MCP Server](#-mcp-server)
 - [Configuration](#%EF%B8%8F-configuration)
 - [Automation](#-automation)
 - [CLI Reference](#-cli-reference)
@@ -51,9 +53,6 @@ openSquat is an **Open Source Intelligence (OSINT)** security tool that identifi
 > **"A powerful swiss army knife for brand protection"**
 > — [WhoisXML API Blog](https://www.whoisxmlapi.com/blog/orchestrating-open-source-software-and-whois-newly-registered-domain-data-feeds-to-fight-the-typosquatting-plague), August 2022
 
-> **"A tool with insane power to fight typosquatting and all related types of cyber mischief."**
-> — [WhoisXML API Blog](https://www.whoisxmlapi.com/blog/orchestrating-open-source-software-and-whois-newly-registered-domain-data-feeds-to-fight-the-typosquatting-plague), August 2022
-
 > **"A handy tool for collecting information on newly registered domains."** — ranked Top 5 phishing detection tool
 > — [SOCRadar Blog](https://socradar.io/blog/top-5-tools-for-phishing-domain-detection/), July 2022
 
@@ -110,6 +109,12 @@ python3 opensquat.py -k keywords.txt
 
 > **Repo users:** in all the examples below, replace `opensquat` with `python3 opensquat.py` to run from a cloned checkout.
 
+### See it in action
+
+<p align="center">
+  <img src="screenshots/openSquat_v2.3.0.png" alt="openSquat 2.3.0 scanning the daily NRD feed for lookalikes of google, facebook, amazon and paypal" width="650"/>
+</p>
+
 ---
 
 ## 📦 Requirements
@@ -285,6 +290,21 @@ Premium API (`--api`) is incompatible with `--doppelganger` and `-d/--domains`.
 
 ---
 
+## 🔌 MCP Server
+
+openSquat is also available as a **Model Context Protocol (MCP) server**, so AI assistants and agents (Claude, and any other MCP-compatible client) can query lookalike-domain intelligence directly:
+
+| Tool | What it does | Quota cost |
+|------|--------------|------------|
+| `search_lookalike_domains` | Find newly registered domains impersonating a brand or keyword (phishing, brand abuse, typosquatting) | 1 query per search |
+| `validate_api_key` | Confirm the connection is authenticated | Free |
+
+Authentication uses the same openSquat account as the Premium modes: either sign in with OAuth, or supply your API key (`os_...`) via the `Authorization: Bearer` header (or `X-OpenSquat-Key`). Searches draw from the same plan quota as the Premium API.
+
+See [opensquat.com](https://opensquat.com) for the MCP endpoint and client setup instructions.
+
+---
+
 ## ⚙️ Configuration
 
 ### Keywords File (`keywords.txt`)
@@ -347,6 +367,7 @@ Run daily via crontab:
 | `--doppelganger` | — | Doppelganger-only mode (keyword in domain + reachability check) |
 | `--ct` | — | Search Certificate Transparency logs |
 | `--phishing` | — | Cross-reference phishing database |
+| `--phishing-fallback` | — | Optional `https` list of phishing domains/URLs, used only when the default database cannot be downloaded |
 | `--subdomains` | — | Fetch subdomains via VirusTotal |
 | `--portcheck` | — | Check for open ports 80/443 |
 | `--vt` | — | Validate against VirusTotal |

{opensquat-2.3.0 → opensquat-2.3.1}/opensquat/__init__.py

@@ -1,4 +1,4 @@
 # -*- coding: utf-8 -*-
 # Module: __init__.py
 """openSquat Version."""
-__VERSION__ = "2.3.0"
+__VERSION__ = "2.3.1"

{opensquat-2.3.0 → opensquat-2.3.1}/opensquat/arg_parser.py

@@ -11,6 +11,7 @@ software licensed under GNU version 3
 
 """
 import argparse
+from urllib.parse import urlparse
 
 from colorama import Fore, Style
 
@@ -37,6 +38,26 @@ def validate_type(file_type):
     return file_type
 
 
+def validate_https_url(url):
+    """
+    Validate a URL given on the command line.
+
+    Args:
+        url: string containing the URL, must be https with a host.
+
+    Return:
+        url
+
+    Raise:
+        If value is not valid, raise an exception to argparse
+    """
+    parsed = urlparse(str(url))
+
+    if parsed.scheme != "https" or not parsed.hostname:
+        raise argparse.ArgumentTypeError("URL must start with https://")
+    return url
+
+
 def validate_confidence(confidence_level):
     """
     Validate confidence_level.
@@ -194,6 +215,14 @@ def get_args():
         default="",
         help="search known and active Phishing sites (arg: output.txt)",
     )
+    parser.add_argument(
+        "--phishing-fallback",
+        type=validate_https_url,
+        default=None,
+        metavar="URL",
+        help="https list of phishing domains/URLs (one per line) used only "
+             "when the default Phishing Database cannot be downloaded",
+    )
     parser.add_argument(
         "--subdomains",
         action="store_true",

{opensquat-2.3.0 → opensquat-2.3.1}/opensquat/cli.py

@@ -301,7 +301,10 @@ def main():
 
     # Check for phishing
     if (args.phishing != ""):
-        file_phishing = phishing.Phishing().main(args.keywords)
+        phishing_check = phishing.Phishing(
+            fallback_db=args.phishing_fallback
+        )
+        file_phishing = phishing_check.main(args.keywords)
         output.SaveFile().main(args.phishing, "txt", file_phishing)
 
     # Check if domain has webserver port opened
@@ -353,6 +356,7 @@ def main():
 
     if (args.phishing != ""):
         print("[*] Phishing results:", args.phishing)
+        print("[*] Phishing source:", phishing_check.source)
         print("[*] Active Phishing sites:", len(file_phishing))
 
     print("[*] Running time: %s seconds" % end_time_squatting)

opensquat-2.3.1/opensquat/phishing.py

@@ -0,0 +1,337 @@
+# -*- coding: utf-8 -*-
+# Module: phishing.py
+"""
+openSquat
+
+(c) Andre Tenreiro
+
+* https://github.com/atenreiro/opensquat
+
+software licensed under GNU version 3
+"""
+import os
+import re
+import sys
+import tempfile
+import time
+from urllib.parse import urlparse
+
+import requests
+from opensquat import file_input
+
+from colorama import Fore, Style
+
+# Phishing lists come from third parties and are untrusted input. These
+# limits keep a compromised or misbehaving source from exhausting memory
+# or disk, or from smuggling anything but hostnames/URLs into the local DB.
+MAX_DB_BYTES = 256 * 1024 * 1024
+MAX_LINE_LENGTH = 2048
+CHUNK_SIZE = 64 * 1024
+# Minimum share of non-comment lines that must look like a host or URL.
+# Below this the source is treated as broken (HTML page, wrong dataset...).
+MIN_VALID_RATIO = 0.5
+# Content types that can never be a plain-text list.
+REJECTED_CONTENT_TYPES = ("html", "xml", "json")
+
+# One entry per line: a hostname (optionally with a port) or an http(s)
+# URL. Strict allow-list of characters: no whitespace, control characters,
+# quotes or backslashes can pass. Matched against the lowercased line.
+LINE_RE = re.compile(
+    r"(?:https?://)?[a-z0-9][a-z0-9_.-]*"
+    r"(?::[0-9]{1,5})?"
+    r"(?:[/?#][a-z0-9._~:/?#@!$&()*+,;=%-]*)?"
+)
+
+
+def redact_url(url):
+    """
+    Return scheme://host[:port]/path without userinfo, query or fragment.
+
+    A user-supplied list URL may carry credentials or an API token; only
+    this form is ever printed or kept for display.
+    """
+    parsed = urlparse(str(url))
+    host = parsed.hostname or ""
+    try:
+        port = parsed.port
+    except ValueError:
+        port = None
+    if port:
+        host = host + ":" + str(port)
+    return parsed.scheme + "://" + host + parsed.path
+
+
+class Phishing:
+
+    """
+    Class Phishing.
+
+    To use:
+        Phishing().main(keyword)
+
+    Attribute:
+        keyword: list of keywords
+    """
+    def __init__(self, fallback_db=None):
+        self.phishing_db = "https://phish.co.za" \
+                           "/latest/" \
+                           "phishing-domains-ACTIVE.txt"
+        # Optional second https list, tried only when the Phishing Database
+        # cannot be downloaded. There is no default: it is chosen by the
+        # user with --phishing-fallback.
+        self.fallback_db = fallback_db
+        # URL of the list that produced the local database in this run.
+        self.source = None
+        self.phishing_filename = "phishing.db"
+        self.keyword = ""
+        self.keywords_filename = ""
+        self.list_domains = []
+        self.keywords_total = 0
+
+    def set_keywords(self, keywords):
+        self.keywords_filename = keywords
+
+    @staticmethod
+    def URL_contains(keyword, phishing):
+        if keyword in phishing:
+            return True
+
+        return False
+
+    def count_keywords(self):
+        self.keywords_total = file_input.InputFile().main(
+            self.keywords_filename,
+            None
+            )
+
+    def check_phishing(self):
+        # keyword iteration
+        i = 0
+
+        # Open phishing DB
+        with open(self.keywords_filename, mode='r', encoding='utf-8') as f_key:
+            for raw_keyword in f_key:
+                keyword = raw_keyword.strip().lower()
+
+                # Skip blank, whitespace-only, and comment lines. Replaces
+                # the old line[0] indexing pattern that crashed on empty
+                # input and also miscounted whitespace-only lines.
+                if not keyword or keyword.startswith("#"):
+                    continue
+
+                i += 1
+                print(
+                    Fore.WHITE + "\n[*] Verifying keyword:",
+                    keyword,
+                    "[",
+                    i,
+                    "/",
+                    self.keywords_total,
+                    "]" + Style.RESET_ALL,
+                )
+
+                with open(self.phishing_filename, mode='r', encoding='utf-8') as f_phishing:
+                    for site in f_phishing:
+                        # Lowercase AND strip newline in one pass. The old
+                        # version assigned site.lower() then overwrote it
+                        # with site.replace("\n", ""), producing a case-
+                        # sensitive comparison that missed mixed-case hits.
+                        phishing_site = site.replace("\n", "").lower()
+
+                        # A list may start with a "#" header line, which is
+                        # not a site and must not match a keyword.
+                        if phishing_site.startswith("#"):
+                            continue
+
+                        if self.URL_contains(keyword, phishing_site):
+                            print(
+                                Style.BRIGHT + Fore.YELLOW +
+                                "  \\_ Similarity detected between",
+                                keyword,
+                                "and",
+                                phishing_site,
+                                "" + Style.RESET_ALL
+                                )
+                            self.list_domains.append(phishing_site)
+
+        return self.list_domains
+
+    @staticmethod
+    def sanitize_db(data):
+        """
+        Reduce a downloaded list to safe lines.
+
+        Return (lines, rejected): the lowercased lines that look like a
+        hostname or an http(s) URL, and how many non-comment lines were
+        dropped. Bad bytes, control characters, ANSI escape sequences,
+        spaces and over-long lines never pass, so they cannot reach the
+        terminal, the output file or the matching code.
+        """
+        text = data.decode("utf-8", errors="replace")
+        lines = []
+        rejected = 0
+
+        for raw in text.split("\n"):
+            line = raw.strip().lower()
+            if not line or line.startswith("#"):
+                continue
+            if len(line) > MAX_LINE_LENGTH or not LINE_RE.fullmatch(line):
+                rejected += 1
+                continue
+            lines.append(line)
+
+        return lines, rejected
+
+    def download_db(self, url):
+        """
+        Download one phishing list.
+
+        Return the raw body, or None when the source is not usable: not
+        https, unreachable, not a 200, an HTML/XML/JSON page, empty or
+        larger than MAX_DB_BYTES. A server that is down answers with an
+        error page (phish.co.za returns a short 503 or 403 HTML page), and
+        that page must not be saved as the database: every keyword would
+        then silently match nothing.
+        """
+        print("[*] Downloading fresh Phishing DB from", redact_url(url))
+
+        if urlparse(url).scheme != "https":
+            print("[!] Phishing DB must be served over https:", redact_url(url))
+            return None
+
+        r = None
+        try:
+            # Timeout so a hung phishing DB server cannot freeze the CLI.
+            r = requests.get(url, timeout=60, stream=True)
+
+            if r.status_code != 200:
+                print("[!] Phishing DB unavailable: HTTP", r.status_code)
+                return None
+
+            # No hop of a redirect chain may use plain http, even when the
+            # chain ends on https: that hop could have been tampered with.
+            hops = list(r.history) + [r]
+            if any(urlparse(str(h.url)).scheme != "https" for h in hops):
+                print("[!] Phishing DB redirected through a non-https URL")
+                return None
+
+            content_type = str(r.headers.get("content-type", "")).lower()
+            if any(t in content_type for t in REJECTED_CONTENT_TYPES):
+                # The header is server-controlled: never echo it.
+                print("[!] Phishing DB is not a text list")
+                return None
+
+            try:
+                declared = int(r.headers.get("content-length", 0))
+            except (TypeError, ValueError):
+                declared = 0
+            if declared > MAX_DB_BYTES:
+                print("[!] Phishing DB is too large:", declared, "bytes")
+                return None
+
+            body = bytearray()
+            for chunk in r.iter_content(chunk_size=CHUNK_SIZE):
+                body.extend(chunk)
+                if len(body) > MAX_DB_BYTES:
+                    print("[!] Phishing DB is too large, aborting download")
+                    return None
+        except requests.exceptions.RequestException as e:
+            print("[!] Phishing DB not reachable:", type(e).__name__)
+            return None
+        finally:
+            if r is not None:
+                r.close()
+
+        if len(body) == 0:
+            print("[!] Phishing DB is empty")
+            return None
+
+        return bytes(body)
+
+    def fetch_list(self, url):
+        """
+        Download one list and return its sanitized lines, or None when the
+        source is unusable.
+        """
+        data = self.download_db(url)
+        if data is None:
+            return None
+
+        lines, rejected = self.sanitize_db(data)
+        total = len(lines) + rejected
+
+        if not lines or len(lines) / total < MIN_VALID_RATIO:
+            print(
+                "[!] Phishing DB rejected: only", len(lines), "of", total,
+                "lines are valid hosts or URLs"
+            )
+            return None
+
+        if rejected:
+            print("[*] Ignored", rejected, "invalid lines from the list")
+
+        return lines
+
+    def save_db(self, lines):
+        """
+        Write the database atomically: a failed run never leaves a half
+        written phishing.db, nor replaces the previous one.
+        """
+        target = os.path.abspath(self.phishing_filename)
+        fd, tmp_path = tempfile.mkstemp(
+            dir=os.path.dirname(target), prefix=".phishing.db."
+        )
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8", newline="\n") as f:
+                f.write("\n".join(lines) + "\n")
+            os.replace(tmp_path, target)
+        except BaseException:
+            if os.path.exists(tmp_path):
+                os.remove(tmp_path)
+            raise
+
+    def update_db(self):
+
+        sources = [self.phishing_db]
+        if self.fallback_db:
+            sources.append(self.fallback_db)
+
+        lines = None
+        for url in sources:
+            lines = self.fetch_list(url)
+            if lines is not None:
+                self.source = redact_url(url)
+                break
+            if url != sources[-1]:
+                print("[*] Trying the fallback list")
+
+        if lines is None:
+            print(
+                "[ERROR] No phishing list could be downloaded. " +
+                "Try again later. Exiting...\n",
+            )
+            sys.exit(-1)
+
+        print("[*] Phishing list source:", self.source)
+        print("[*] Phishing entries:", len(lines))
+        self.save_db(lines)
+
+        return True
+
+    def main(self, keywords):
+        """
+        main function that will call other functions.
+
+        Args:
+            keyword: keyword to search for(duh)
+
+        Return:
+            none
+        """
+        print("")
+        print("+---------- Checking Phishing sites ----------+")
+        time.sleep(2)
+        self.set_keywords(keywords)
+        self.update_db()
+        self.count_keywords()
+        return self.check_phishing()

{opensquat-2.3.0 → opensquat-2.3.1}/opensquat.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opensquat
-Version: 2.3.0
+Version: 2.3.1
 Summary: openSquat - Detection of domain squatting, typosquatting, IDN homograph attacks, and phishing threats
 Author-email: Andre Tenreiro <andre@opensquat.com>
 License-Expression: GPL-3.0-only
@@ -36,7 +36,8 @@ Dynamic: license-file
 <h1 align="center">openSquat Core</h1>
 
 <p align="center">
-  <a href="#"><img src="https://img.shields.io/badge/python-3.10+-blue.svg" alt="Python 3.10+"></a>
+  <a href="https://pypi.org/project/opensquat/"><img src="https://img.shields.io/pypi/v/opensquat" alt="PyPI"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.10+-blue.svg" alt="Python 3.10+"></a>
   <a href="https://github.com/atenreiro/opensquat/blob/master/LICENSE"><img src="https://img.shields.io/badge/License-GPLv3-blue.svg" alt="License: GPL v3"></a>
   <a href="https://github.com/atenreiro/opensquat/issues"><img src="https://img.shields.io/github/issues/atenreiro/opensquat" alt="GitHub issues"></a>
   <a href="https://github.com/atenreiro/opensquat/stargazers"><img src="https://img.shields.io/github/stars/atenreiro/opensquat" alt="GitHub stars"></a>
@@ -54,6 +55,7 @@ Dynamic: license-file
 - [Requirements](#-requirements)
 - [Usage](#-usage)
 - [Premium and API Modes](#-premium-and-api-modes)
+- [MCP Server](#-mcp-server)
 - [Configuration](#%EF%B8%8F-configuration)
 - [Automation](#-automation)
 - [CLI Reference](#-cli-reference)
@@ -82,9 +84,6 @@ openSquat is an **Open Source Intelligence (OSINT)** security tool that identifi
 > **"A powerful swiss army knife for brand protection"**
 > — [WhoisXML API Blog](https://www.whoisxmlapi.com/blog/orchestrating-open-source-software-and-whois-newly-registered-domain-data-feeds-to-fight-the-typosquatting-plague), August 2022
 
-> **"A tool with insane power to fight typosquatting and all related types of cyber mischief."**
-> — [WhoisXML API Blog](https://www.whoisxmlapi.com/blog/orchestrating-open-source-software-and-whois-newly-registered-domain-data-feeds-to-fight-the-typosquatting-plague), August 2022
-
 > **"A handy tool for collecting information on newly registered domains."** — ranked Top 5 phishing detection tool
 > — [SOCRadar Blog](https://socradar.io/blog/top-5-tools-for-phishing-domain-detection/), July 2022
 
@@ -141,6 +140,12 @@ python3 opensquat.py -k keywords.txt
 
 > **Repo users:** in all the examples below, replace `opensquat` with `python3 opensquat.py` to run from a cloned checkout.
 
+### See it in action
+
+<p align="center">
+  <img src="screenshots/openSquat_v2.3.0.png" alt="openSquat 2.3.0 scanning the daily NRD feed for lookalikes of google, facebook, amazon and paypal" width="650"/>
+</p>
+
 ---
 
 ## 📦 Requirements
@@ -316,6 +321,21 @@ Premium API (`--api`) is incompatible with `--doppelganger` and `-d/--domains`.
 
 ---
 
+## 🔌 MCP Server
+
+openSquat is also available as a **Model Context Protocol (MCP) server**, so AI assistants and agents (Claude, and any other MCP-compatible client) can query lookalike-domain intelligence directly:
+
+| Tool | What it does | Quota cost |
+|------|--------------|------------|
+| `search_lookalike_domains` | Find newly registered domains impersonating a brand or keyword (phishing, brand abuse, typosquatting) | 1 query per search |
+| `validate_api_key` | Confirm the connection is authenticated | Free |
+
+Authentication uses the same openSquat account as the Premium modes: either sign in with OAuth, or supply your API key (`os_...`) via the `Authorization: Bearer` header (or `X-OpenSquat-Key`). Searches draw from the same plan quota as the Premium API.
+
+See [opensquat.com](https://opensquat.com) for the MCP endpoint and client setup instructions.
+
+---
+
 ## ⚙️ Configuration
 
 ### Keywords File (`keywords.txt`)
@@ -378,6 +398,7 @@ Run daily via crontab:
 | `--doppelganger` | — | Doppelganger-only mode (keyword in domain + reachability check) |
 | `--ct` | — | Search Certificate Transparency logs |
 | `--phishing` | — | Cross-reference phishing database |
+| `--phishing-fallback` | — | Optional `https` list of phishing domains/URLs, used only when the default database cannot be downloaded |
 | `--subdomains` | — | Fetch subdomains via VirusTotal |
 | `--portcheck` | — | Check for open ports 80/443 |
 | `--vt` | — | Validate against VirusTotal |

{opensquat-2.3.0 → opensquat-2.3.1}/opensquat.egg-info/SOURCES.txt

@@ -31,4 +31,5 @@ tests/test_arg_parser.py
 tests/test_auth.py
 tests/test_ct.py
 tests/test_feed_manager.py
+tests/test_phishing.py
 tests/test_validations.py

{opensquat-2.3.0 → opensquat-2.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "opensquat"
-version = "2.3.0"
+version = "2.3.1"
 description = "openSquat - Detection of domain squatting, typosquatting, IDN homograph attacks, and phishing threats"
 readme = "README.md"
 license = "GPL-3.0-only"