Skip to content


Folders and files

Last commit message
Last commit date

Latest commit



44 Commits

Repository files navigation


Generate similar-looking domains for phishing attacks. Check expired domains and their categorized domain status to evade proxy categorization. Whitelisted domains are perfect for your C2 servers. Perfect for Red Team engagements.


bundle install

Current Algorithms

  • SingularOrPluralise
  • prependOrAppend
  • doubleExtensions
  • mirrorization
  • homoglyphs
  • dashOmission
  • Punycode

Version 1.1.0:

The parser for command line options is modified to compensate with the new expired feature. This new option structure gives the tool a new look and more organized.


Running the tool:

catphish.rb [global options] COMMAND [command options]


  generate                    Generate domains
  expired                     Find available expired domains

Additional help
  catphish.rb COMMAND -h

Global Options
  -l, --logo, --no-logo                      ASCII art banner
                                             (default: true)
  -c, --column-header, --no-column-header    Header for each column
                                             of the output (default:
  -D, --Domain=<s>                           Target domain to analyze
  -V, --Verbose                              Show all domains,
                                             including non-available
  -h, --help                                 Show this message

Generate all type:

catphish.rb -D DOMAIN generate -A

Check available expired domains:

catphish.rb -D DOMAIN expired

Check against a specific domain for categorization status:

catphish.rb -D DOMAIN expired -c

Check all available expired domains against a specific vendor

catphish.rb -D DOMAIN expired -p PROXY_TYPE


You can also run the tool with Docker! This lets you try it out without any of the required dependencies (ruby), except Docker itself. This presumes that you have the docker daemon installed. If not, see Docker's documentation.

First, build the container

$ cd path/to/repository

# Generate a tag so we know how to find the container later to run it. You can use anything (latest is common);
# here the git hash is used.
$ TAG=$(git rev-parse --short HEAD)

# Run the build
$ docker build --tag "catphish:${TAG}" .

# Eventually docker will print something like:
#   Successfully built 8f0b8bfe0c41
#   Successfully tagged catphish:f947517

Perfect! Now, you can execute catphish via Docker:

$ docker run \
    --rm=true \
    "catphish:${TAG}" \
        --Domain \

In Action

alt tag


This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see


CATPHISH project - For phishing and corporate espionage. Perfect for RED TEAM.






No releases published


No packages published