Announcing Site Canaries

Domain monitoring covers lookalike registrations, Certificate Transparency (CT) discoveries, passive DNS, and the infrastructure behind them. All of it looks outward, at names an attacker registers or stands up. A cloned or phishing copy of a customer-facing website can slip past these detections, hidden behind obfuscation, hard-to-guess paths, or a hostname that never resembled the brand in the first place.

How Site Canaries detect cloned pages#

Site Canaries, now available on Have I Been Squatted, work from the protected page outward instead. A small script embedded in that page reports every load back into the platform, including the hostname that served it. Recognized hostnames account for normal traffic. Anything else is flagged, and can carry the same malicious lookup tags already used for domain monitoring.

Each deployment is tied to an existing monitored domain and produces a single script tag to embed. Recognized hostnames are set alongside that embed as exact names or leading wildcards such as *.example.com, so internal hosts and development domains stay out of the flagged set.

Reported loads land in the Site Canaries view, which charts recognized and flagged activity over time and lists each flagged hostname with its load count, monitored domain, and deployment.

Enabling Site Canaries#

Site Canaries are available to Enterprise customers as an add-on.

1. In the Have I Been Squatted console, open a monitored domain and go to Settings, then Site Canaries, or open "Site Canaries" from the sidebar.
2. Create a deployment, set recognized hostnames, and copy the embed code.
3. Add the script to pages that should run the Site Canary, and adjust Content Security Policy rules if the site uses them.

Site Canaries complement Domain Monitoring by catching cloned pages on their first load, before staged phishing infrastructure has time to collect credentials.