Have I Been Squatted vs Axur

• Choose Axur for Brand Protection across social profiles, apps, paid search, dark-web channels and credential exposure, with automated notices to hosts, registrars and platforms. ^1–11
• Choose Have I Been Squatted to detect malicious domains, including lookalikes from certificate transparency, inspect them in a live, isolated browser session, and block them in Zscaler, Cloudflare Zero Trust or Microsoft Defender for Endpoint. ^12–22
• Use both if Axur runs your wider brand and takedown program and your security team also wants domain evidence, rules and gateway response inside its own stack. ^{1–2,15,19–25}

At a glance#

Have I Been Squatted and Axur on the decisions a buyer weighs first.

	Have I Been Squatted	Axur
What you get
What you get	Detection and response for malicious domains12	External threat platform with Brand Protection workspaces1
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context13–14	Smart Monitoring: TLD-squat, homoglyph, typosquat, combosquat26–27
Evidence for investigation
Evidence for investigation	Redirects, page content and network requests15,17,23	Logo, brand-mismatch and color fields2,5,10
Delivery to security tools
Delivery to security tools	SIEM connectors, Slack, Tines and webhooks28–29	SIEM, SOAR and chat connectors, webhooks, TAXII2,4,30–33
Blocking
Blocking	Gateways, endpoints, mail quarantine, hosted domain feed19–22	Through Infoblox Threat Defense34–35
Managed takedowns
Managed takedowns	Domains, to host and registrar, with escalation36–39	Hosts, registrars, platforms; Web Safe Reporting1–3,6–11
Beyond domains
Beyond domains	Not covered: social, apps, dark web, credentials40–41	Social, apps, ads, dark web, credentials, executives1–5
How you buy
How you buy	Self-serve monitoring subscription13,39	Contract with an annual takedown package1,42

Coverage beyond lookalike domains#

Axur suits teams that investigate brand abuse across social profiles, apps and paid search as well as domains. Brand Protection covers fake mobile apps, malware, similar domain names, fake social profiles, phishing, branding in paid search and fraudulent trademark use. Other workspaces cover online piracy, data leakage, the deep and dark web, and executives, and Axur also sells Cyber Threat Intel and External Attack Surface Management. ^1–5,43

Axur states that Deep and Dark Web monitoring covers more than three thousand channels, including WhatsApp, Telegram and Discord groups. Threat Hunting lets analysts search credentials, cards, URLs and domains in the same data lake, so a leaked password and a phishing domain can sit in one investigation. ^1–2,4,44

Have I Been Squatted concentrates on domains and the threats built on them. Domain Monitoring generates lookalikes and watches certificate transparency and newly registered domains. Email Intelligence adds mail telemetry from Microsoft 365 and Google Workspace, and Site Canaries flag copies of your own pages. Have I Been Squatted does not monitor social media, app stores, the dark web, ads or leaked credentials. ^{13–14,39–41,45–47}

How each product finds and inspects a lookalike#

Axur's Smart Monitoring of Similar Domains stays active without a manual setup step. The default rule combines TLD-squat and homoglyph matching. Customers can refine Lucene queries for typosquats and combosquats, filter to domains with an active MX record, and simulate the query in Threat Hunting. Axur's help center places subdomain detections, such as a brand label on a hosting subdomain, outside that monitoring. Infoblox now runs this detection in one pipeline with the lookalike detection from Infoblox Threat Defense. ^{11,26–27,44,48–50}

Tickets attach a screenshot, the HTML and a WHOIS file. Similar-domain and phishing tickets also list the hosting provider, ASN, DNS records and SSL certificate details, and analysts can jump from those fields into Threat Hunting. Clair supplies visual fields such as logo detection, brand mismatch, threat category and an AI risk score. ^{2–5,10–11,49,51–53}

Have I Been Squatted gives your analysts the domain evidence to inspect. Discovery combines generated lookalikes, with named kinds such as homoglyphs, bitsquats and TLD swaps, with certificate transparency and newly registered domains. Results combine RDAP registration data, hosting details, DNS records, mail readiness, open ports and a capture of the website where available. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score, and page semantics record observations such as a request for an account password. An analyst can check whether a lookalike resolves, is set up for email or serves a copied page, then open it in an isolated browser. No public documentation of Axur certificate transparency monitoring was found. ^{2,5,13–15,17–18,23–24,39,43,54–59}

Both products ship a cloned-site script. Axur's OnePixel is a per-customer script with no usage limit that reads the HTTP referer when a copied page loads your site. Have I Been Squatted Site Canaries do the same job with a script matched against hostname patterns, with up to five active deployments per monitored domain. ^47,60–61

Either product can carry a lookalike investigation. Choose Axur when visual triage fields and one queue for domain, social and app cases matter most. Choose Have I Been Squatted when you want certificate transparency in discovery, page semantics and isolated browsing behind each domain. ^{1–5,13–15,17–18,23,52}

Following a lookalike to the rest of a campaign#

Axur's Threat Hunting searches its whole data lake, not only your own assets, across credentials, cards, URLs and domains. Axur markets it for pivoting across exposed credentials, cards and phishing indicators at scale, and Infoblox says Digital Risk Protection Services correlates related domains and attacker assets into campaigns. Investigation reports download from the Investigations panel, and Threat Hunting results export to CSV. ^{1–2,4,11,44,51,62–63}

Have I Been Squatted follows the infrastructure with Atlas investigations, which are in early access. An admin describes the hunt and can seed it with lookalike domains already in hand, and Atlas pivots across shared infrastructure in its store of domain observations. Indicators such as IP addresses, nameservers or favicon hashes can be added later for it to pivot on. It keeps watching once the first pass ends and lays the results out in views such as Tree, Table, Clusters and Flows. An investigation exports to STIX 2.1, CSV, JSON or Markdown. No public documentation of a graph view or an infrastructure-pivot API was found for Axur. ^{4,11,37,51,57–58,64–67}

Takedowns

Follow a Takedown from request to outcome.

A demo shows the Takedown case workflow and the Network Enforcement gateways that receive blocks.

Book a demoStart free trial

Acting on a finding in your own tools#

Axur connects tickets and intelligence into security operations. Named connectors reach SIEM, SOAR, chat and threat-intel tools such as Splunk, Microsoft Sentinel, IBM QRadar, Rapid7 InsightIDR, ServiceNow and MISP, with webhooks signed HMAC-SHA256 and a TAXII collection for IOCs. Infoblox says Digital Risk Protection Services findings can feed Infoblox Threat Defense to block destinations while takedowns run. No public documentation of delivery to third-party gateways such as Zscaler, Cloudflare Gateway or Microsoft Defender was found. Axur also runs MCP servers for Threat Hunting, CTI, Tickets, Customers and EASM, which Axur marks as an experimental release. ^{2,4,30–35,68–70}

Have I Been Squatted puts response in rules that run over domain signals. A maintained rules library covers common detections, and your team can add its own. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list, mark the result Malicious with a note or request a Takedown. An analyst or an agent can also send one response for a result immediately, outside any rule. The MCP server covers lookups, monitoring queries, rules, alerts, Takedowns, response dispatch, result annotation and documentation search, and every write needs an organization admin. ^{15,23–25,28,39,66,71–76}

Network Enforcement blocks flagged domains in Zscaler Internet Access, Cloudflare Zero Trust and Microsoft Defender for Endpoint, and adds mail blocks in Microsoft 365 and Cloudflare Email Security. Other tools can poll a hosted domain feed. Findings reach Splunk, Microsoft Sentinel and Google SecOps, or any endpoint through signed webhooks. CrowdStrike Falcon receives domains as detections. ^{19–22,28–29}

No public documentation of an Axur Microsoft 365 or Google Workspace mailbox connector was found. Have I Been Squatted Email Intelligence correlates lookalike senders from those mail systems without changing MX records. ^{31,33,45–46}

Managed takedowns and their targets#

Both products handle takedown requests for you. Axur lets users with the Expert or Manager profile request takedowns in the platform or through its API, and advertises notices that draft, send, read replies and escalate. Only resolved Axur takedowns count against the package, and a recurrence at the same URL and host within fifteen days does not count again. Axur publishes a conditional first-notification SLA when documents comply with platform policies. ^{1–3,6,10,36–37,51,77–83}

Axur reaches more kinds of target. Automated notifications go to providers, registrars and platforms, including a direct channel to the XYZ domain registry. Spoofing notices go to the registrar and email provider. Executive takedown covers fake social profiles and executive data on lead-sales sites. Web Safe Reporting sends phishing and malware URLs to entities such as Google Safe Browsing and APWG. Axur marketing also names direct channels with Meta and Mercado Livre, and coverage of paid search, social media and app stores. Parked lookalikes without content are not eligible, and Axur does not handle domain disputes or legal action. ^{1–3,6–11,68,82,84–85}

Have I Been Squatted runs managed Takedowns for domains. An analyst reviews every request, and a rule can open a request automatically. The team reports the domain to its host and registrar, then escalates to ICANN and regional CSIRTs where necessary. The service stops short of legal action and can introduce legal partners. ^36–39

Both products can connect detections to takedown requests. Choose Axur for its wider target coverage, automated notice handling and browser-blocklist reporting. Choose Have I Been Squatted when you want analyst-reviewed domain Takedowns beside its domain evidence and Network Enforcement. If you run both, decide which product owns domain triage and takedown requests. ^{1–3,6–11,15,19–23,36–37,68,77}

Where Axur is the better choice#

Axur fits when digital risk spans channels that a domain product does not cover, such as social impersonation, fake apps, paid-search abuse, dark-web collection, credential and card exposure, executive protection and online piracy. It also suits teams that want managed triage through SmartHunt and analyst help from the Axur Research Team. Managed security providers can manage customer tenants and credit limits through the Customers API, with four access profiles separating viewers from people who request takedowns. ^{1–7,10,77,86}

Axur suits buyers who want takedowns billed only when content is removed, with a published first-notification SLA. Web Safe Reporting reaches browser and antivirus entities, and Infoblox Threat Defense can block destinations while work proceeds. Buying starts with a platform demo and a quote. ^{1,9–10,34–35,68,80,87}

Where Have I Been Squatted is the better choice#

Have I Been Squatted fits a security team that works malicious domains and the attacker infrastructure behind them, and wants each one blocked in its own controls while removal runs. Network Enforcement pushes rule-flagged domains into Zscaler Internet Access, Cloudflare Zero Trust, iboss and Microsoft Defender for Endpoint, and adds mail blocks in Microsoft 365 and Cloudflare Email Security. Tools that poll a list can read a hosted domain feed in seven formats, among them STIX 2.1 and CSV, with documented MISP setup. Network Intelligence then shows whether devices on your network connected to the domain. ^{12,19–22,25,88}

Each domain also gets a closer look. Domain Monitoring checks your domains continuously and adds certificate transparency and newly registered domains to the lookalikes it generates, and Analyze inspects any other domain on demand. When a domain serves a page, an analyst can open it in a live, isolated browser session. Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, including sender and URL domains, with the domains you monitor. Managed Takedowns cover takedown and disruption of malicious infrastructure, starting with reports to the host and registrar. ^{13–15,17–18,36–39,45–46,73–74,89–90}

You can start on your own. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, and Takedowns and the email, network, SIEM and canary products are bought through sales. Results leave as a PDF "Domain security overview" or "Compliance readout", or as CSV and JSON exports. For a security review, Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center, and supports single sign-on and audit logging. End users can add free Browser Protection for Chrome. ^{13,18,24,37,39,57,66–67,73–74,88,91–93}

Have I Been Squatted does not suit a buyer who needs social media, app stores, the dark web, ads or leaked credentials monitored alongside domains. Axur covers those channels in one platform. ^{1–5,40–41}

FAQ#