Have I Been Squatted now works inside the AI apps your team already uses. Ask in plain language to find domains impersonating you, check what they serve and act on what you find. The evidence stays in the conversation, next to the alert or ticket that raised the question, instead of in a dashboard tab you copy from.
It is available today in Claude, ChatGPT, Codex, GitHub Copilot, Cursor, Slack and the Have I Been Squatted dashboard. See how it works.
What you can ask#
Find lookalikes. "Which domains are impersonating acme.com?" Your agent scans for registered lookalikes ranked by evidence, finds unregistered ones worth registering defensively and searches certificate transparency logs for new certificates that imitate your brand. With monitoring, it also searches results across your monitored domains.
Investigate a domain. "Is acrne.com phishing?" Your agent checks DNS, registration, hosting and the live site, and returns a verdict. It can render the page and report what it asks visitors for, such as passwords or one-time codes. In Claude, ChatGPT and Codex, results appear inline with a screenshot, a hosting map and every signal.
Act on it. "Make this a rule." "Send this to Splunk." "Block it." Your agent can raise an alert on every new match, send findings to Slack, a webhook or your SIEM, block domains in Microsoft Defender for Endpoint, Cloudflare Zero Trust or Microsoft 365 Exchange, raise detections in CrowdStrike Falcon or Microsoft Sentinel, and open a managed takedown case. Changes need an organization admin, and your app asks you to confirm first.
A worked example#
In Claude, ask about a suspicious domain. Your agent analyzes it live and leads with the verdict.
Claude: Investigate acrne.com. Who hosts it, and what does the page do?
Then ask Claude to send the finding to Splunk or another connected tool, and it asks you to confirm before anything goes out. The domains and addresses in this example are fictional.
Where it works#
ChatGPT and Codex
Coming to the Plugins directory. Until then, install the Codex plugin from agent-plugins.
Claude
Add Have I Been Squatted from the Connectors directory on claude.ai, Claude Desktop and Claude mobile.
Microsoft 365 Copilot
Coming soon to the Agent Store in Copilot.
Slack
Add the app to your workspace, then mention @Have I Been Squatted in a channel or send it a direct message.
The dashboard
Open Assistant from the header or press Cmd+J (Ctrl+J on Windows and Linux). It knows which page you have open.
GitHub Copilot
Install the plugin from agent-plugins in GitHub Copilot CLI.
Cursor, OpenCode and other MCP clients
Add the server address as a remote MCP server. You sign in the first time you use it.
The agent page has setup steps and the server address for each client. Lookups work on every plan. Monitoring, rules and alerts need a Pro, Business or Enterprise plan. Takedowns and response connectors are add-ons.
Built on your existing access#
Your agent signs in with your own Have I Been Squatted account, stays in the organization you pick and has the same access you have in the dashboard. Adding an app does not give that app your data. Changes need an organization admin and your approval, blocks never apply to your own monitored domains, and every call is logged. Content from suspicious domains is treated as data, never as instructions. To turn off changes through agents for your whole organization, contact [email protected].
Get started#
Add Have I Been Squatted from your app's connector or plugin directory. In Claude Code, Codex, Cursor, GitHub Copilot or OpenCode, copy the setup prompt and paste it into your agent instead.
Works withChatGPT, Claude, Copilot, Cursor or GitHub Copilot
The MCP server guide and Slack app guide have the full details.
Domain protection
Detect adversary infrastructure while it is being staged.
Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.