Best typosquatting detection tools

Short answer#

• Scan on your own machine: dnstwist generates and resolves lookalikes of one domain, with optional page-similarity scores. ^1–6
• Check once in a browser: Typosquatting finder (CIRCL) lists registered lookalikes in a browser, with no install. ^7–8
• Repeat checks without running anything yourself: Have I Been Squatted, CheckPhish and dnstwister watch your domains and send alerts. Have I Been Squatted also turns findings into blocks and Takedown requests with rules. ^9–18
• Hand removal to a vendor across many channels: Bolster, Netcraft, Red Points or ZeroFox run takedowns for domains, social media, app stores and more. ^19–54
• Hunt lookalikes inside an investigation platform: DomainTools Iris Detect or Silent Push, when your analysts already work in that data. ^55–58

A typosquatting detection tool takes a brand domain, or brand keywords, that you name. It then finds registered lookalike domains and reports them. dnstwist prints one run's output, Have I Been Squatted sends a scheduled alert, and ZeroFox analysts work a case for you. Phishing URL feeds, DNS filters, email security, package-registry checkers, visitor-side browser warnings and bulk data feeds that take no brand input are out of scope. This page compares a selection of these tools, grouped by how you run them. ^{6,10,29–30,59}

1. Local scan

   Runs on your machine against the domains or keywords you supply

   You supply the schedule and storage

   • dnstwist
   • URLCrazy
   • urlinsane
   • DNSRazzle (dnstwist engine)
   • openSquat (keyword feed match)

2. Browser check

   Runs one check in a browser with no install

   You repeat checks by hand

   • Typosquatting finder (CIRCL)
   • dnstwist.it (dnstwist's own page)
   • dnstwister
   • Have I Been Squatted (sign-in needed)

3. Self-serve monitoring

   The service repeats checks and sends alerts

   You sign up and review alerts

   • Have I Been Squatted
   • CheckPhish
   • dnstwister

4. Managed service

   A vendor team detects, reviews and takes down

   You authorize and review the vendor's response

   • Bolster
   • Netcraft
   • Red Points
   • ZeroFox
   • Nine more

5. Investigation platform

   Lookalike monitors inside a threat data platform

   Your analysts work the results

   • DomainTools Iris Detect
   • Silent Push

Certificate feeds and search datasets

Certificate transparency sources and dataset searches. They supply data to a lookalike workflow; you supply the query or the keywords.

• crt.sh
• CertStream
• Phishing Catcher
• Censys
• urlscan.io
• VirusTotal

Local scan#

These five tools run on your machine, and their source is public. You supply the schedule, the storage and, apart from DNSRazzle's email report, the alert routing. dnstwist comes first because DNSRazzle and dnstwister build on its engine. ^{1–3,6,60–65}

Local scanners as rows: how each finds candidates, whether it compares pages, and the constraint that most affects how you run it.

	How it finds candidates	Page comparison	Operating constraint
dnstwist
dnstwist	Permutations of one domain, then DNS resolution3,6,66	ssdeep or TLSH HTML similarity; screenshot hash3,6,67	One domain per run; no scheduler6
URLCrazy
URLCrazy	Typo and word-level variants of one domain, then DNS68–70	Not found70–71	Restricted license: commercial services other than penetration testing need a separate license68,70,72–74
urlinsane
urlinsane	Typosquat variants of one seed; multilingual on master75–77	Content ssdeep in release 0.8.2; not found on master78–79	Rewritten engine needs a source build75,80–81
DNSRazzle
DNSRazzle	dnstwist-based permutations of many domains per run82–83	SSIM screenshot comparison against the original83–84	Sends SMTP test messages to lookalike mail servers by default62,85
openSquat
openSquat	Keyword match against a daily newly registered domain feed86–92	Not found88,93	Default feed: personal and research use only94

dnstwist#

Best for a security engineer who wants a scanner they run, script and self-host. ^1–3

dnstwist is a domain permutation engine for detecting homograph phishing, typosquatting and brand impersonation. One run takes one domain, generates permutations and resolves each one. The fuzzer set covers keyboard layouts, bitsquatting, per-TLD IDN glyph rules, and dictionary and TLD files. Output goes to CSV, JSON or a bare list, lookups can use a custom or DNS-over-HTTPS resolver, and a Python API suits scripted runs. ^{1,3,6,66–67}

Optional checks go past DNS. dnstwist scores page similarity with ssdeep or TLSH on the HTML and with a screenshot hash, each as a percentage, and saves the screenshots to disk. The opt-in --mxcheck probe flags lookalike mail servers that accept an SMTP session, --whois adds the creation date and registrar, and --banners adds HTTP and SMTP banners. The maintainer reports use by tens of SOC and incident response teams, and the README lists integrations such as a Splunk add-on and Maltego. ^{1,3–6,67,95}

Marcin Ulikowski maintains dnstwist, open source and free under Apache License 2.0. The latest release shipped in January 2025. The last commit landed in April 2025, and the repository is not archived. dnstwist.it runs a quick scan in a browser. Install it from the dnstwist repository, and read Have I Been Squatted vs dnstwist. ^{1–3,6,96–100}

URLCrazy#

Best for a penetration tester or analyst who wants misspelling and TLD breadth from one command. ^{68–69,101–103}

URLCrazy takes one domain, generates variants and resolves each one. Word-level generators cover common misspellings, homophones and singular or plural forms, and -k selects a QWERTY, AZERTY, QWERTZ or Dvorak layout. Wrong TLD walks 1,513 TLDs, and All SLD adds country second-level domains in the same run. -f and -o write CSV or JSON to a file. ^{68–70,101–105}

URLCrazy installs locally with no service account, and -r skips DNS resolution. Optional -p, off by default, asks a search engine for result counts, which the project presents as an estimate of how popular a typo is. Andrew Horton maintains URLCrazy, and the README dates its first publication to 2009. Kali Linux packages it, and Repology lists packages for Parrot, BlackArch and the AUR. ^{68,70–72,74,106–110}

The license is a custom Restricted license, not an OSI-approved one. It allows use and distribution, but modified versions need the maintainer's permission, and a commercial service other than penetration testing, such as domain protection for clients, needs a separate license. The last release shipped in July 2025, with no later commit by November 2026. Install it from the URLCrazy repository, and read Have I Been Squatted vs URLCrazy. ^{68,70,72–74,109–112}

The excerpt below shows a URLCrazy run with the original domain and four candidates. URLCrazy does not check whether a domain is registered, so a row with a DNS answer is a lead to investigate, not evidence of abuse. ⁶⁸

$ urlcrazy -n haveibeensquatted.com
URLCrazy Domain Report
Domain    : haveibeensquatted.com
Keyboard  : qwerty
At        : 2026-11-04 23:58:00 +0100
# Please wait. 2229 hostnames to process

Typo Type           Typo Domain                  IP
Original            haveibeensquatted.com        2606:4700::6812:13f5
Character Omission  haveibeensquated.com
Character Repeat    haveibeeensquatted.com
Wrong TLD           haveibeensquatted.dev        76.76.21.21
Wrong TLD           haveibeensquatted.ws         64.70.19.203

urlinsane#

Best for an engineer who builds from source and wants multilingual domain variants, with package and username squat checks in the same local tool. ^{5,75,113–124}

Release 0.8.2, from November 2024, is the pre-rewrite engine, with screenshot, banner, content ssdeep and redirect collectors. The rewritten graph engine on master needs a source build and adds WHOIS. No documentation of those web collectors on master was found. The CLI reference calls master mid-rewrite and lists flags that are specified but not built. ^{75–76,78–81,122–127}

On master, 32 algorithms cover same-language and cross-language homophones, common misspellings, number words and 133 keyboard adjacency sets. Delegated-subdomain variants sit under free hosts such as duckdns.org and github.io, and a TLD swap runs across the public suffix list. Three-state existence (live, absent, unknown) keeps a failed lookup from reading as a free name, and clustering groups results on a shared address, nameserver or registrant, with Graphviz output. Master also generates email, package, username and repository-name variants, checks whether packages and usernames exist and flags dependency confusion. With the bundled endpoints, repository existence returns an undetermined result. ^{5,75–76,113–121,125,128–132}

For CI, master exits with code 2 on --fail-on, writes deterministic output and NDJSON after the scan completes, marks partial results and replays saved scans. One target runs per invocation, and the automation guide shows cron and CI schedules. No public documentation of a built-in scheduler or alert delivery was found. The code is GPL-3.0, and a public book documents the engine. The last commit on master landed in August 2026, and the repository is not archived. Build it from the urlinsane repository, and read Have I Been Squatted vs urlinsane. ^{75–76,80,114–116,122–124,133–139}

DNSRazzle#

Best for a team that wants screenshot comparison and multi-brand runs from a local script, and accepts active mail probes. ^{4–5,62,82–85,140}

DNSRazzle builds on a pinned older dnstwist engine and adds a url-encoded-slash permutation for %2F link tricks. -d takes a comma list and -f a file, so one run covers many brands. Playwright captures viewport screenshots of each lookalike and scores them against the original site with SSIM. Optional nmap and dnsrecon runs probe the lookalikes that this path selects, and a blocklist file collects hosts behind visually similar pages. ^{4–5,61–62,82–85,140–143}

The MX check connects to each lookalike's mail server and sends an SMTP test message, and no flag turns it off. Results stay on disk, and -e emails a CSV report through your own SMTP server. The final feature release shipped in April 2026, and the project now takes bug fixes only. The maintainer names SecurityShrimp Highlander, a separate commercial product, as its replacement. DNSRazzle is Apache-2.0 with no account or contractual scan quota, and talks at Kernelcon and Health-ISAC describe its use by Baxter's security team. Clone the DNSRazzle repository, and read Have I Been Squatted vs DNSRazzle. ^{60,62,82–83,85,140–141,144–150}

openSquat#

Best for a researcher who wants a daily keyword match against new registrations, run locally. ^86–93

openSquat downloads a newly registered domain feed and matches brand keywords locally. The default daily feed lists about 100,000 domains, needs no account, and ships with a checksum file so unchanged downloads are skipped. Homograph handling transliterates non-Latin characters to Latin before comparing, so a Cyrillic lookalike can match. Optional flags add Quad9 reputation, VirusTotal votes, a phishing database, port checks and crt.sh, and output goes to TXT, JSON or CSV for cron jobs. ^{86–92,94,151–156}

openSquat also sells hosted plans, from a free Community plan to USD 199 a month for Business. Every plan includes daily keyword alerts by email, an API and an MCP server, and openSquat adds Slack and Microsoft Teams alerts from Professional. A larger NRD Lite feed costs USD 39 a month. The API returns an IDN flag and the Unicode rendering for each homograph. The code is GPL-3.0. The default feed carries its own notice, which limits it to personal and research use and prohibits commercial use. The Community and Starter plans are also non-commercial, and the commercial license starts at Professional, at USD 49 a month. Maintenance is active, and the October 2026 release treats downloaded phishing lists as untrusted input. The repository had 989 stars and 163 forks in November 2026. Install it from the openSquat repository, and read Have I Been Squatted vs openSquat. ^{86–87,94,151,157–169}

Free check in a browser#

These pages run one check with no install, and you repeat it by hand. The other two rows belong to tools profiled in other groups. ^{15,96,100,170–175}

One-off checks in a browser as rows: access, what each checks and what you get back.

	Access	What it checks	What you get
CIRCL Typosquatting finder
CIRCL Typosquatting finder	No account7–8,172,176	Misspellings, homophones, numeral swaps, dynamic-DNS suffixes177–181	Result table; JSON and MISP downloads176,182–183
dnstwist.it
dnstwist.it	No sign-in96,100,173	dnstwist permutations of one domain96	Table of permutation, IP address, name server, mail server96
dnstwister search
dnstwister search	No sign-in; keyless public API15,174–175	Similar domains with A and MX records174–175,184–185	Found, available and error lists; CSV export186

Have I Been Squatted's Typosquat tool runs the same kind of one-off lookup after sign-in, so it is not a row above. ^9,187–189

Typosquatting finder (CIRCL)#

Best for a one-off check in a browser, and for MISP users. ^{7–8,182,190–191}

CIRCL runs a public browser check. Its permutation set covers common misspellings, homophones, numeral and plural forms and dynamic-DNS suffixes. A TLD swap runs across 1,441 bundled TLDs plus public-suffix second levels, with a wildcard DNS test for each variation. When that option is on, the website software compares a lookalike's page text and resources with the original and reports a combined ratio. Results download as JSON, a MISP feed or a MISP event, and the library emits YARA, regex and YAML for other tools. ^{7–8,171–172,176–183,190–194}

CIRCL is the CERT for Luxembourg's private sector, communes and non-governmental entities, and the library acknowledges EU co-funding. The stack is open source end to end, with a BSD-2-Clause library and an Apache-2.0 website that you can self-host. PyPI statistics count 49,109 library downloads in one month, mirrors and CI included. The interface is one-shot, and no public documentation of recurring monitoring or alerts was found. In a November 2026 check, the hosted REST route returned a server error. Open the CIRCL Typosquatting finder, and read Have I Been Squatted vs CIRCL Typosquatting finder. ^{7–8,170–172,176,195–201}

Self-serve hosted monitoring#

These services repeat checks and send alerts. You sign up, add a domain and review findings. Have I Been Squatted is listed first because this is its own site, and the other two follow in editorial order. ^11–15,202

Self-serve hosted monitoring as rows: where candidates come from, how often checks repeat, and what happens after a finding.

	Where candidates come from	Cadence	After a finding
Have I Been Squatted
Have I Been Squatted	Permutations, certificate transparency, newly registered domains, business context10,202	Stated at least once every 24 hours202	Slack, webhooks, SIEMs, blocking, Takedown requests and email digests16–18,203–204
CheckPhish
CheckPhish	Typosquat variants of one domain11	Weekly variant scans11–14	Email alerts11–12,205
dnstwister
dnstwister	Generated lookalikes of each monitored domain184,206–207	About every 24 hours15	Email and RSS alerts; IP or CIDR mutes15,186,206

Have I Been Squatted#

Best for a security team that wants discovery beyond permutations, evidence it can inspect, and rules that block in its own tools or request a Takedown. ^{4–5,9–10,16–18,202}

Have I Been Squatted starts from lookalikes and goes on to the malicious infrastructure behind them. Domain Monitoring combines permutations built on the open-source engine twistrs with certificate transparency and newly registered domains. The twistrs README states the goal of porting dnstwist, and lookups are stated to run at least once every 24 hours. The signal catalog lists 173 domain signals, and a result can include page semantics, favicon hashes, open ports, mail readiness and HAR data. An analyst can see whether a lookalike resolves, is set up for email or serves a copy of your page, then open it in an isolated browser. ^{4–5,9–10,188,202,208–210}

Rules turn those signals into actions. A maintained library covers common detections, and your team can write its own rules. One rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list, mark the result Malicious with a note or request a Takedown. Network rules stand alone and cannot block, annotate or request Takedowns. Managed Takedowns include analyst review, and the team reports each domain to its host and registrar, escalating where necessary. An MCP server and a Slack app let agents work the same queue, and every write needs an admin. ^{4–5,9,16–18,187,189,203–204,211–214}

Beyond registered names, Discover lists unregistered permutations of your domain that could be used for phishing or brand impersonation. Pipelines can call the Public API, which streams lookup, analyze and certificate transparency search results as NDJSON, with scoped API keys and a Python SDK. Network Enforcement also publishes rule-flagged domains in a hosted domain feed with seven formats, among them CSV and STIX 2.1, and documents a MISP setup for it. Network Intelligence reads Microsoft Defender every 15 seconds and Cloudflare Gateway every minute, so you can see which domains devices on your network reached. Atlas investigations, in early access, start from a described hunt and any domains you already suspect, and pivot across shared infrastructure to related domains. ^{4,18,188–189,215–223}

Domain Monitoring, hunting tools, rules and alerts are a public self-serve subscription, priced per monitored domain, with a 14-day trial. Takedowns and the email, network, SIEM and canary products are bought through sales. Have I Been Squatted does not monitor social media, app stores, ads or the dark web. Its Takedowns stop short of legal action, though the team can introduce third-party legal providers. See pricing. ^{9,202,219,224–225}

CheckPhish#

Best for one brand domain that needs weekly typosquat checks with email alerts. ^{11–12,14,205,226}

CheckPhish is Bolster's free tool. It monitors one brand domain, and more domains route to Bolster, which also runs the managed takedowns. Monitoring generates up to 300 typosquat variants of the domain and live-scans up to 100 of them each week, with email alerts. ^{11–12,14,205,226–227}

The URL scanner returns a screenshot, the DOM and WHOIS, and CheckPhish advertises certificate and hosting details too. Verdicts use a broad scam taxonomy, with 12 disposition identifiers such as drug spam and streaming. Scans can use a preset or custom user agent, and an API key with a documented quota supports scripts. Listed integrations include a Microsoft Security Copilot plugin, an Outlook add-in, a community Splunk SOAR connector and Tines templates. Open the CheckPhish homepage. ^{12,14,226,228–234}

dnstwister#

Best for daily email alerts on a few domains. ^15,235

dnstwister's hosted service checks lookalikes of each monitored domain about every 24 hours and resolves A and MX records for each one. Alerts arrive by email and RSS, with a separate list for new MX records. IP and CIDR mutes cut repeat noise, a newly_monitored flag separates algorithm changes from fresh registrations for seven days, and each alert email carries a management link. For removal, dnstwister publishes a takedown guidance template. No public documentation of a takedown service was found. ^{15,186,206,235–238}

Monitoring is a public self-serve subscription for one domain or a multi-domain estate, with a four-week trial that needs no card. More than 100 domains needs a contact. The open-source web app, under the Unlicense, wraps a modified copy of dnstwist, while the hosted service code is private. On November 4 and 8, 2026, the status page listed open issues with DNS resolution and delta calculations, and the public /api/ip/ endpoint returned errors for well-known domains, so check the status page before you rely on it. Try dnstwister.report, and read Have I Been Squatted vs dnstwister. ^{63–65,235,239–241}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

Managed detection and takedown#

These vendors detect lookalike domains and run takedowns, usually across channels beyond domains. Order is alphabetical, and the split between these profiles and the shorter table further down is editorial. ^{27,44,242–248}

Managed detection and takedown as rows: who runs the takedown, the response step beyond removal, and the channels covered beyond domains.

	Takedown model	Response beyond removal	Channels beyond domains
Bolster
Bolster	Bolster starts it for phish and scam findings, automatically or by a SOC analyst19–25	Playbook adds domains to the Exchange and Defender block list249	Social, app stores, marketplaces, ads, deepfakes, dark web31–35
Netcraft
Netcraft	Automated takedown, escalation to managed26	Browser and antivirus feed blocking while a takedown runs250–251	Social, ads, apps, dark web, phone numbers, scam conversations36–40
Red Points
Red Points	Fully managed by IP-Ops specialists27–28	Domain recovery through UDRP, URS and national proceedings46,252–253	Social, ads, app stores, marketplaces, search deindexing46–51
ZeroFox
ZeroFox	ZeroFox analysts handle every takedown29–30	Partner blocking, including Google Web Risk priority review30,254–255	Social, app stores, dark web, credentials, executive and physical security29,52–54

Bolster#

Best for a brand, fraud or security team that wants automatic takedowns across web, social, app stores and marketplaces. ^{19–21,23,31–35}

Bolster detects lookalikes and starts the takedown itself for a newly scanned URL judged phish or scam, either automatically or through a SOC analyst. Coverage reaches social media, app stores, marketplaces, paid ads, deepfakes and the dark web. A documented permutation set of 13 types includes homoglyphs and bitsquatting. ^{19–25,31–35,256}

Threat Graph links one finding to related infrastructure so takedowns can be coordinated. A playbook adds Bolster-identified domains to the Microsoft Exchange and Defender block list, and playbook connectors cover Slack, Teams, Splunk, Sentinel and XSOAR. The Scan API returns logo detection output, and the customer license sets its quota and rate. Bolster says it is partnering with Akamai on capture from multiple vantage points and calls that work still in progress. Bolster is bought through a quote-based contract, and it owns CheckPhish. Contact Bolster, and read Have I Been Squatted vs Bolster. ^{23,31,42,242,244,249,257–270}

Netcraft#

Best for an organization that wants managed takedown at scale, with blocking while it runs. ^{250–251,271}

Netcraft combines managed takedowns with feeds that browsers and antivirus vendors use to block threats while removal proceeds. A customer reports or authorizes an attack, can set auto-authorization by attack type, and can escalate an automated takedown to a managed one. Netcraft states that most removals go through direct API or provider contacts, and that it takes down about one-third of global phishing attacks. Preemptive Domain Disruption targets domains before content goes live. ^{26,250–251,271–273}

Anti-cloaking capture uses a proxy network, a headless browser and multi-stage form filling. Takedowns run from the SOC through documented XSOAR commands and a bi-directional Splunk app. Coverage reaches social media, ads, apps, the dark web, phone numbers and scam conversations. Netcraft states that its SOC 2 Type 2 report has no exceptions, and Forrester evaluated it in its External Threat Intelligence Service Providers Wave for Q3 2026. Netcraft is bought through a quote-based contract. Use the Netcraft contact form, and read Have I Been Squatted vs Netcraft. ^{26,36–41,274–279}

Red Points#

Best for a consumer or retail brand with registered trademarks that wants a vendor to run enforcement across many channels, including UDRP recovery of domains. ^{46–51,252–253,280}

Red Points runs domain work inside a wider brand protection platform. Domain Management detects, monitors and reclaims domains that misuse a brand, and Impersonation Removal handles fake sites, beside modules for counterfeits, social media, ads and apps. Red Points also markets coverage of deepfakes and Mainland China. IP-Ops specialists run detection, validation and enforcement, and they handle pushbacks and counter-notices. A dedicated Customer Success Manager supports each customer. Red Points compares logos, page images, objects and extracted text against brand assets, including for domains that do not contain the brand name. ^{27–28,46–51,246,252,280}

Red Points recovers domains through UDRP, URS and national dispute proceedings. It claims to suspend fraudulent domains before content is published, through registrar and host partnerships. Programs are bought through a quote-based contract at a flat fee, with unlimited detections and takedowns within the agreed scope, and GoDaddy customers have a separate fake-website protection offer. Red Points reports 300 or more employees, 1,300 or more brands, a SaaS model since 2014, and offices in the US, Spain and China. ^{46,252–253,280–284}

Enforcement needs trademark or patent certificates for each protected territory, a Letter of Authorization and a business license. After activation, the customer validates incidents in the portal, and Red Points says that validation can also be automated. Request a Red Points quote, and read Have I Been Squatted vs Red Points. ^28,46,285

ZeroFox#

Best for an organization that wants analyst-validated alerts and managed takedowns across social, apps and domains under one contract. ^29–30,286

ZeroFox analysts handle every takedown and remediation, and customers request work in the platform or through the API. A takedown counts against the contract only when it completes. Targets reach past domains to social profiles, apps, marketplace listings, personal data on data brokers and UDRP filings. While a takedown runs, partner blocking includes Google Web Risk priority review. ^{29–30,254–255}

A 24x7 managed service validates critical and high alerts before they reach you. Anti-cloaking analysis gets past geofencing, device fingerprinting, CAPTCHAs and delayed rendering. The integration library names more than 40 SIEM, SOAR, TIP, ITSM, BI and chat connectors, plus webhooks and STIX/TAXII, and ZeroFox reports Forrester recognition for brand threat intelligence and takedown services. Direct purchase is a quote-based contract, and UK public-sector buyers can also buy through G-Cloud resellers. Each contract sets a yearly takedown allowance and a number of protected domains. Review ZeroFox Domain Protection, and read Have I Been Squatted vs ZeroFox. ^{29,248,278,286–290}

More managed services#

Nine more managed vendors describe lookalike domain detection. Axur offers one-click and Zero-Touch Takedowns, BrandShield offers managed, self-service and hybrid models, and PhishFort also takes single takedowns of incidents you already found. SOCRadar offers a free account with no expiry date. ^291–323

Nine further managed services with lookalike detection and takedowns, alphabetical: takedown model, one distinct strength and how you buy.

	Takedowns	Distinct strength	How you buy
Axur
Axur	One-click or Zero-Touch Takedowns312–317	OnePixel cloned-site detection script324	Contract with an annual takedown package325–326
BrandShield
BrandShield	Managed, self-service and hybrid models318–320	Named Threat Hunter and 24/7 SOC295,327–329	12-month AWS Marketplace contract with takedowns295
CloudSEK XVigil
CloudSEK XVigil	In-house team runs takedowns end to end297,330–333	Re-scans past fake domains on WHOIS, SSL or re-registration changes334	12-month contracts on AWS Marketplace335
Doppel
Doppel	Internal SOC executes every takedown336–338	Threat Graph links domains, profiles, ads and phone numbers339–340	Quote-based contract341
Fortra Brand Protection
Fortra Brand Protection	Managed; works with registrars on the customer's behalf302,304	Analysts validate detections before escalation302–303,342	Quote-based contract343–345
Group-IB
Group-IB	Three-stage managed takedown; power of attorney required305,346	Escalation to a cease-and-desist pre-trial order305,346	Quote-based contract305,347
PhishFort
PhishFort	Analysts validate and file takedown requests321,348–349	Blocklist submissions in parallel with each takedown211,306,350–351	Quote-based managed service321
Recorded Future
Recorded Future	One-click takedown requests; PhishFort operates the service308,352–354	Logo hash, screenshot OCR and login-form checks on lookalike pages309	Quote-based contract354–355
SOCRadar
SOCRadar	Managed takedown team with one-click submission310,356	Anti-Phishing Web Token detects cloned pages310,356	Quote-based contract310

• Have I Been Squatted vs Axur
• Have I Been Squatted vs BrandShield
• Have I Been Squatted vs CloudSEK
• Have I Been Squatted vs Doppel
• Have I Been Squatted vs Fortra
• Have I Been Squatted vs Group-IB
• Have I Been Squatted vs PhishFort
• Have I Been Squatted vs Recorded Future
• Have I Been Squatted vs SOCRadar

Investigation platform with lookalike monitors#

These platforms treat lookalike discovery as one module inside a wider investigation or threat-intelligence workflow. ^55–58

Investigation platforms with lookalike monitors: what you watch, how often it runs, how alerts arrive and what an analyst does next.

	DomainTools Iris Detect	Silent Push
What you watch
What you watch	A keyword term as an Iris Detect monitor56–57,357	A target domain or an assets folder of domains or IPs358–360
Cadence
Cadence	New domains near real time; watched domains tracked daily56,357,361–362	Monitors every 24 hours; saved searches every 5 minutes, hourly or daily359,363–364
Alerts
Alerts	Email alerts; Ignore marks false positives357,365–366	In-app, email, Slack, Teams or webhook358,363,367–369
Next step
Next step	Escalate to Google Web Risk and track the status361,370	Pivot on favicon, ssdeep, JARM and banners to related infrastructure371–373

DomainTools Iris Detect#

Best for an investigation or SOC team that already works in DomainTools data. ^{55–57,374–377}

Iris Detect monitors a keyword term for lookalike domains, using 15 named variation algorithms with IDN and fuzzy matching. A provisional proximity and phishing score arrives within minutes, and the full score follows in 15 to 25 minutes. WHOIS history, hosting history, more than a decade of passive DNS from Farsight DNSDB and screenshot history sit behind each result. The Iris Pivot Engine adds guided and historical pivots, IrisQL, collaboration and reports. ^{56–57,357,365,374–381}

Domain and IP risk feeds, hotlists and RPZ delivery support blocking at scale, and more than 25 named SIEM, SOAR, TIP and XDR integrations carry results into the SOC. A hosted MCP server exposes Iris Investigate, DNSDB and Domain History to agents. No public documentation of a managed takedown service was found. Iris Detect needs a DomainTools account under a quote-based contract. Review DomainTools Iris Detect, and read Have I Been Squatted vs DomainTools. ^{55–57,361,366,370,381–388}

Silent Push#

Best for a threat intelligence team that treats lookalikes as one input to infrastructure hunting. ^{58,369,389–390}

Silent Push Domain Impersonation takes a target domain, and Assets Impersonation searches a folder of domains or IPs. From one lookalike, an analyst can pivot on favicon hashes, ssdeep, JARM and banners, and read passive DNS and WHOIS history, to find the infrastructure around it. First-party scan data spans six data sources, searchable with SPQL, and Traffic Origin adds proxy and VPN origin data. ^{358–360,371–373,391–396}

IOFA feeds, APT feeds, TLP Amber reports and analyst services extend the work to threat actors, and Silent Push states that IOFA often reveal attacks three to six months in advance. It lists 20 named SIEM, SOAR and TIP integrations, plus TAXII. Silent Push is bought through a demo and a quote, and also offers a free account. Review Silent Push, and read Have I Been Squatted vs Silent Push. ^{369,389–390,397–405}

Certificate feeds and search datasets#

Certificate transparency sources supply new names, and you supply the brand terms and the matching. crt.sh is a free certificate search with no sign-up and guest SQL access to the whole database. In November 2026 checks, some guest SQL connection attempts were refused, and its database and web search lagged the CT logs by more than two weeks. CertStream defines a simple MIT-licensed websocket JSON format that pushes each new certificate to clients, and an active Go server fork supports self-hosting. Its public demo server sent no entries in a November 2026 test, so plan to run your own. No public documentation of lookalike generation was found for either. Phishing Catcher, a GPL-3.0 CertStream consumer, scores every name in the stream with editable YAML keyword weights and checks for confusable characters and one-edit typos. It reads the public CertStream server unless you edit the code, and its last commit on master dates from December 2020. ^406–442

Censys, urlscan.io and VirusTotal search their own datasets for lookalikes and can watch a query over time. Censys's CenQL twist function finds typosquats, and collections send webhooks and email digests. urlscan.io searches Newly Observed Domains with exact, fuzzy and regex queries, and subscriptions send new matches by email or webhook. VirusTotal Livehunt rules use permutation_of, and Digital Threat Monitoring in Google Threat Intelligence also watches domain registrations. Each also serves wider investigation. Censys scans every IPv4 port, urlscan.io keeps a historical scan corpus with visual search, and VirusTotal adds multi-engine reputation and free relationship data. ^443–465

Choose by need#

Two questions settle most choices. Who reviews the findings, and who handles the response? If your team reviews and responds with its own scripts, a local scanner or a browser check is enough. If your team reviews but wants the tool to repeat checks and trigger alerts, blocks or takedown requests, choose hosted monitoring. If you want a vendor to review findings and remove abuse across social media, app stores and marketplaces, choose a managed service. If your analysts already hunt in DomainTools or Silent Push data, add their lookalike monitors. ^{6,16–18,29,31–35,55–58,286}

Is Have I Been Squatted right for you?#

Choose Have I Been Squatted when your security team wants lookalike discovery it does not have to run, a path from each lookalike to the infrastructure behind it, and a response it controls. Domain Monitoring watches permutations, certificate transparency and newly registered domains continuously. Each result shows whether the lookalike resolves or is set up for email, and an analyst can open a live page in an isolated browser session. Rules then alert, block the domain in your gateways and endpoints or request a Takedown, and you can start self-serve with a free trial. For a one-off check, use its Typosquat tool or a local scanner. For the channels and the legal action outside the scope in its profile, choose a managed vendor. ^{5,9–10,16–18,187–189,202,210,217–218,224–225,466–467}

FAQ#