When a lookalike domain turns up, two questions follow almost every time: did anyone reach it, and is it blocked? Until now, answering them meant a hunting query in one console and a change request in several others.
Network Intelligence and Network Enforcement are now available on Have I Been Squatted, and answer both in one place. Network Intelligence shows which malicious domains your devices connect to, from the Microsoft Defender data you already collect. Network Enforcement blocks the domains your rules flag in the controls you already run.
Network Intelligence: See every destination. See which domains your endpoints and the AI agents on them reach out to.
Network Intelligence: see what your devices reach#
Connect Microsoft Defender for Endpoint and Network Intelligence starts working with the data you already have. There's no new agent to deploy.
The domains your devices reach are counted, and first-time destinations stand out on their own, so a lookalike nobody had visited before doesn't get lost in the noise. Blocked connections are only half the story: Network Intelligence also shows how many connections to a malicious domain got past your controls.
It counts destinations, not people. It doesn't record which device connected.
Network Enforcement: block it everywhere#
A rule decides what gets blocked, so your team never maintains a block list by hand. When a rule flags a domain, every connected control receives it from that same rule, and every delivery is recorded for audit. The next person to click the link sees a block page instead of the attacker's sign-in form.
These controls are available today:
Web gateways
Endpoints
Firewalls and DNS
For any firewall that fetches a list over HTTPS, such as Palo Alto, Fortinet, Check Point, Sophos and pfBlockerNG.
More are coming soon. See the full list on the integrations page.
One match, every response#
The two work together. When a rule flags a malicious domain, it blocks the domain across your controls and requests a Takedown before anyone opens a ticket. Network Intelligence then shows whether anyone still reached it, and whether the block held.
Available today#
Network Intelligence and Network Enforcement are available now for Enterprise customers as add-ons. If you're already a customer, contact us to learn more. If you're not, book a demo to see them on your own traffic.
Monitoring tells you a lookalike exists. Now Have I Been Squatted also shows whether it reached your network, and stops it there.
Domain protection
Detect adversary infrastructure while it is being staged.
Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.