diff --git a/pkgs/tools/networking/dnstwist/default.nix b/pkgs/tools/networking/dnstwist/default.nix
new file mode 100644
index 00000000000..e19b4dabd78
--- /dev/null
+++ b/pkgs/tools/networking/dnstwist/default.nix
@@ -0,0 +1,37 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "dnstwist";
+  version = "20201228";
+  disabled = python3.pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "elceef";
+    repo = pname;
+    rev = version;
+    sha256 = "0bxshi1p0va2f449v6vsm8bav5caa3r3pyknj3zf4n5rvk6say70";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [
+    dnspython
+    GeoIP
+    ppdeep
+    requests
+    tld
+    whois
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "dnstwist" ];
+
+  meta = with lib; {
+    description = "Domain name permutation engine for detecting homograph phishing attacks";
+    homepage = "https://github.com/elceef/dnstwist";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 00f21302c23..0beb8a18a73 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30921,6 +30921,8 @@ in
     inherit (darwin) libresolv;
   };
 
+  dnstwist = callPackage ../tools/networking/dnstwist {};
+
   dsniff = callPackage ../tools/networking/dsniff {};
 
   wal-g = callPackage ../tools/backup/wal-g { };