Build a MagicMock response. The explicit `headers` default to `{}` (not a MagicMock). Without this, `response.headers.get("Retry-After")

Query the lookalike endpoint for a single keyword. Args: keyword: brand/term to search for (URL-encoded internally)

Resolve the openSquat API key from CLI > env var > key file. Args: cli_value: value from --api-key flag, or None/empty key_f

Extract a human-readable error detail from an HTTP response. Preference order: 1. JSON body's "detail" field (for well-f

Helper to print to buffer or stdout (with reset style)

Run get_args with a fake sys.argv and return the Namespace.

Check the domain reputation using DNS resolvers (Quad9). Prints results (or writes to buffer) and updates malicious list.

Mask an API key for safe display in error messages and logs. Returns 'os_abcde...wxyz' style for keys long enough, otherwise '***'.

Downloads the latest registered domains.

Load the keywords file into self.list_file_keywords.

Checks if the local feed file is up to date by comparing MD5 checksums. Premium feeds skip the freshness check entirely (no .md5 sibl

Compute Levenshtein distance using native Python. When threshold is provided, applies early exit optimizations: - Skips computation if l

Build the CSV output rows: a header row followed by one data row per domain. Premium API mode populates the metadata columns from Lookali

Build the JSON output structure: a list of per-keyword objects, each with a "domains" array of {"domain": ..., ...} dicts. In Premium AP

Print the mode-specific lines of the run summary.

Load the domain feed file into self.list_file_domains.

Return the first non-comment, non-blank, stripped line of a text file. Returns None if no usable line is found.

Run --api mode. One APIClient shared across a thread pool, one task per keyword. Honors --dns by annotating each returned domain and

Extract and validate local filename from feed URL. Prevents path traversal attacks from crafted URLs.

Serialize a LookalikeDomain into a JSON-friendly dict. Optional fields (tld, date, unicode) are omitted when they're None so the output

Save to CSV. self.content must be a list of rows, where each row is a list of column values. The first row is treated as the

save to json. Args: none Return none

save to plain text. Args: none Return none

Count number of domains (lines) from the domains file. Args: none Return: self.domain_total: total

Count number of keywords from the keyword file the counter will ignore the chars "#", "\n" and " ". Args: none

Fetch the VT domain report and return [harmless, malicious]. Returns: list[int]: [harmless_votes, malicious_votes]. Retu

Ensures that the feed file exists and is up to date.

main function that will call other functions. Args: keyword: keyword to search for(duh) Return: non

Method to print some configuration information.

Method to print configuration info for Premium API mode (no feed).

Method to read domain and keywords files (community/premium modes).

Fetch the list of subdomains of self.domain from VirusTotal. Returns: list[str]: list of subdomain strings. Returns an e

Method that will compute all the similarity calculations between the keywords and domain names.

Initiator.

Initiator.

Initiator.

Initiator.

Initiator.

initiator.

Worker for one keyword in API mode. Runs in a thread.

Checks a single keyword against a list of domains. This method is designed to be run in a separate process.

Check if domain contain homograph character. Args: none Return: none

Parser main function. Args: none Return: args: returns arguments

Convert homograph domain to LATIN characters. Args: none Return: none

main function that will call other functions. Args: file_name: file name (duh) file_type: file type (txt, js

Run a VirusTotal lookup. Args: domain: domain to look up mode: "report" (default) returns [harmless, malicio

main function that will call other functions. Args: domain: the domain name (duh) Return: none