Have I Been Squated– Instantly spot typosquatting, brand abuse, and domain threats with real-time alerts.
© 2026 Have I Been Squated, Inc. All rights reserved.
We redesigned the domain dashboard and monitoring results pages for faster triage, with a richer expanded result view and a timeline that shows how a domain's analysis changed over time.
Browse a curated library of detection rules maintained by our security team and subscribe to the ones relevant to your brand — no query writing required.
Domain discovery now lets you define your own Certificate Transparency search terms per monitored domain, surfacing lookalike and brand-related certificates that default permutations might miss.
Connect Google Workspace to bring Gmail audit telemetry — including user-reported spam and phishing — into domain risk analysis. Builds on Email Intelligence for Microsoft 365.
Connect your Microsoft 365 tenant to close the loop from inbox to infrastructure — correlate sender domains with domain risk scoring and push quarantine rules back into Exchange Online. Deployable in minutes with no MX changes.
Domain analysis now crawls monitored sites to map pages, capture broken and external links, scan exposed services, and fingerprint favicons — all available as rule signals.
sitemap.*)ports.*)favicon.*)We added a certificates view in the app, subdomain discovery, and support for additional DNS record types.
We launched a streaming HTTP API with token-based authentication and scopes, covering domain lookups, analysis, and Certificate Transparency search.
Request and manage domain takedowns directly from the console. Track takedown requests, filter by status and reason, and monitor progress for malicious domains targeting your brand.
certgrep FreeWe launched certgrep, our free public certificate transparency (CT) search engine for security professionals.
Read the announcement on the blog: /blog/announcing-certgrep.
Analyze historical DNS and TLS observations to map infrastructure changes and uncover relationships across suspicious domains.
passive_dns.*, passive_tls.*)
We launched our in‑house ML model for domain classification to significantly improve accuracy and reduce false positives.
classification.phishing, classification.legitimate, classification.parked
twistrs: New Vowel Shuffle and improved Hyphenation permutationsxiaomi.com → xoaimi.com)bbc.co.uk → bbc-co.uk)
Analyzer is a one-shot domain detective that brings every essential insight into a single view: a live snapshot of the site, cache status and legitimacy, redirect chain, HTTP banner and tech-stack overview, DNS records, registration and registrar details, security flags with WHOIS/RDAP links, and a built-in certificate inspector.
We're building a rules system to let you define alerts based on specific domain traits — think composable alerts tailored to your brand. Create custom rules that trigger when domains match your criteria, whether it's detecting lookalike domains, monitoring specific TLDs, or flagging suspicious registration patterns, allowing you to stay informed about potential threats while filtering out the noise.
You can now view the complete redirect chain for any domain, with detailed visibility into every certificate encountered along the way. For each certificate, we display the subject, issuer, validity period, subject alternative names, certificate transparency status, and connection security details such as protocol, cipher, and key exchange.
This lets you quickly assess certificate legitimacy, expiration, and transparency for every hop in the redirect path, making it easier to spot suspicious or misconfigured certificates.
You can now export data from both the Explore and Lookup views inside Domain Monitoring. Export your findings as CSV for spreadsheet analysis or JSONL for programmatic processing — perfect for custom reporting, data pipelines, or integration with your existing security tools.
We've added result tagging capabilities to help you organize and categorize your domain monitoring results, along with bulk domain import functionality to streamline your workflow.
We now identify the tech stack running on detected websites — useful for phishing detection and infrastructure profiling. This includes detecting web frameworks, content management systems, analytics tools, and other technologies that can reveal the true nature of suspicious domains and help assess their legitimacy.
We've shipped a comprehensive overhaul of our monitoring platform featuring enhanced detection algorithms, deeper infrastructure inspection capabilities, and improved threat assessment workflows for more accurate domain monitoring.
We've shipped NXDOMAIN lookups. Now you can discover unregistered domain permutations that could be used for phishing or brand impersonation. NXDOMAIN responses indicate that a domain name doesn't exist in the DNS system, revealing potential typosquatting opportunities before attackers can register them.
We gave the app a fresh look and added some powerful sorting and export features.
prefers-reduced-motion support)