Have I Been Squatted vs Bolster

• Choose Bolster for protection across domains, social media, app stores, marketplaces, paid ads and the dark web, with takedowns that Bolster starts itself for Phish and Scam findings. ^1–16
• Choose Have I Been Squatted to detect malicious domains and the infrastructure behind them, write the rules yourself, block them in your own gateways and endpoints, and see whether your devices reached them. ^17–26
• Use both if Bolster runs your wider brand program and your security team wants domain rules and response in its own stack, with one product named as the owner of domain triage and takedown requests. ^{1–5,18–25,27–30}

At a glance#

Have I Been Squatted and Bolster on the decisions a buyer weighs first.

	Have I Been Squatted	Bolster
Takedown review
Takedown review	Analyst reviews every request31–32	Bolster starts Phish and Scam takedowns itself10–16
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context33–34	AI variants, SEO search, asset seeds35–38
Website analysis
Website analysis	Redirects, HAR, DOM, crawl and page semantics19–20,39	Daily screenshot and DOM capture40–41
Detection and triage
Detection and triage	Legitimate, parked or phishing, with confidence18–20,33,42	Dispositions Clean, Phish, Scam, Suspicious35,41,43–44
Response in your tools
Response in your tools	Rule alerts, SIEM events, blocks, Takedown requests18,21,45–47	Playbooks to Slack, Teams, Splunk, Sentinel, XSOAR or an API48–54
Managed takedowns
Managed takedowns	Domains, to host and registrar, with escalation27,31–32,55	Domains, social, apps, marketplaces, ads, blocklists2,4–5,13–14,38,48,56–57
Beyond domains
Beyond domains	Not covered: social, apps, dark web58–59	Social, apps, marketplaces, ads, dark web2–4,6–9
How you buy
How you buy	Self-serve monitoring subscription27,33	Quote-based contract13,35,37,41,60

Coverage beyond lookalike domains#

Bolster brings monitoring and takedowns for websites, social media, apps and marketplaces into one platform. A brand, fraud, security or legal team can hand fake profiles, rogue apps and counterfeit listings to the same vendor that handles lookalike sites, and Bolster opens takedowns across those channels. Dark Web AI Monitoring adds dark-web coverage, Customer Abuse Mailbox accepts forwarded customer reports, and Deepfakes lets analysts check suspicious images and video for manipulation inside an investigation. Fraudulent Ads finds ads that impersonate the brand across paid search, sponsored placements and social channels, then submits takedown requests through the platforms' trust and safety portals. ^{1–5,8,13–15,35,38,48,56–57,61–64}

Have I Been Squatted covers domains and the threats built on them. Domain Monitoring generates lookalikes and watches certificate transparency and newly registered domains. Email Intelligence adds mail telemetry from Microsoft 365 and Google Workspace. Site Canaries put a JavaScript tripwire on your own pages and flag page loads on hostnames you did not approve, so a copied or proxied page that still runs the script shows up. ^{27,33–34,65–68}

How each product investigates a lookalike domain#

Bolster ties lookalike discovery to automatic classification and takedown. AI search finds likely variants of the domains registered on the platform, and real Google and Bing searches find SEO-driven fraud sites. An asset catalog of logos, trademarks, social accounts, marketplace accounts and apps tells Bolster what attackers may try to imitate. A documented set of 13 variant types covers Exact Match TLD swaps, Homoglyph, Bit Squatting and related patterns. Each scanned site gets a daily screenshot and DOM capture. Computer vision models read images, text and images of text, and the Scan API returns logo detections with brand, bounding box and probability, along with the redirect chain. Platform dispositions are Clean, Phish, Scam and Suspicious. ^{35–38,40–41,43–44,69–70}

Have I Been Squatted gives your analysts the domain evidence to inspect. Discovery combines generated lookalikes, with named kinds such as homoglyphs, bitsquats and TLD swaps, with certificate transparency and newly registered domains. Results can include RDAP registration data, hosting, DNS records, mail readiness, open ports and a website capture. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score, separate from the scores that rule authors assign. An analyst can check whether a lookalike resolves, is set up for email or serves a copied page, then open it in an isolated browser. ^{18–20,27,29,33–34,39,42,71–75}

Both products pivot from one finding to related infrastructure. Bolster's Threat Graph, inside Signals, groups related URLs and domains into campaigns and links them to hosting providers, redirect destinations, reported emails, phone numbers and social media platforms. Each campaign lists the domains and hosting providers it shares with other campaigns, which supports coordinated takedowns, and Bolster connects discovery and classification to automatic takedown requests. No public documentation of Threat Graph connections through IP addresses, nameservers or certificates was found. ^{1,10–16,76–80}

Have I Been Squatted runs the pivot as an Atlas investigation, in early access. An investigation starts from a short description of the hunt, optionally with domains you already suspect, then follows shared infrastructure through Atlas, the store of domain observations. An admin can add indicators such as IP addresses or nameservers for it to pivot on. It keeps watching after the first pass and re-checks for new matches. Results open in views such as Tree, Table, Clusters and Flows, and an investigation exports to STIX 2.1, CSV or JSON. ^{32,74–75,81–84}

Automatic takedowns and their targets#

Bolster can start takedowns without a customer review, and Have I Been Squatted has an analyst review every request. When Bolster classifies a URL as Phish or Scam, it starts the takedown itself, either automatically or through one of its SOC analysts. Clean or Suspicious findings must be disputed first, and the dispute opens a takedown request. Bolster acts on the Destination URL and keeps monitoring the Source URL. ^10–16

Have I Been Squatted runs managed Takedowns for domains, and a rule can open a request automatically. The team reports the domain to its host and registrar, then escalates to ICANN and regional CSIRTs where necessary. The service stops short of legal action and can introduce legal partners. ^{27,31–32,55}

Bolster reaches more kinds of target. Takedowns go to registrars, registries and hosting providers through API partners or evidence-backed reports, and also to social platforms, app stores, marketplaces, paid ads and global blocklists. Partner examples include AWS, Cloudflare, GoDaddy and Namecheap, and Bolster often sends the customer's registered trademark as proof of ownership. ^{2,4–5,13–14,38,48,56–57}

Choose Bolster when a case can move from a domain to a social profile, an app, a marketplace listing or a paid ad. Choose Have I Been Squatted when the case is a malicious domain and you want the Takedown tied to the monitoring and rules that found it, with an analyst on every request. ^{2,4–5,10–16,18–21,27,31–32,38,48,55–57}

Takedowns

Follow a Takedown from request to outcome.

A demo shows the Takedown case workflow and the Network Enforcement gateways that receive blocks.

Book a demoStart free trial

Acting on a finding in your own tools#

Bolster connects findings to security workflows through playbooks. A playbook has an output definition, a query that selects which data to send, a connector and a schedule. Documented connectors cover Slack, Teams, Splunk, Microsoft Sentinel and Cortex XSOAR, plus a generic HTTP API connector, and Bolster's integrations page lists 46 integrations. A Microsoft 365 Exchange/Defender playbook pushes Bolster-identified domains to the tenant allow/block list. No public documentation of customer-editable detection rules was found. ^{48–54,85–88}

Have I Been Squatted puts response in rules that run over domain signals. A maintained library covers common detections, and your team can add its own. A rule can raise an alert, deliver a finding to a SIEM such as Splunk or Microsoft Sentinel, push a domain to a block list or request a Takedown. It can also mark each matched result with a status such as Malicious and a note. Network Enforcement blocks flagged domains in Cloudflare Zero Trust, Zscaler Internet Access and Microsoft Defender for Endpoint, and publishes a hosted domain feed. ^{18–25,27,45–47,89}

An analyst can also send one response for one result outside any rule. That response can be a notification, a SIEM finding, a block or a detection in CrowdStrike Falcon. An MCP server lets agents work the same alerts and Takedowns, and every write needs an admin. ^{28,30,83,90–91}

No public documentation was found of Bolster blocking connectors for Cloudflare Gateway or Zscaler, or of a connector that reads mail across a Microsoft 365 or Google Workspace tenant. The documented setup for Customer Abuse Mailbox forwards a published abuse mailbox to Bolster, and Bolster says it also connects to Microsoft Outlook and Microsoft Defender so reports flow from that mailbox. The Exchange connector pushes domains to the tenant block list, and Cloudflare appears in Bolster's partner list as a hosting provider that receives takedowns. ^{1,14–15,48,51,62–63,86–88}

Where Bolster is the better choice#

Bolster fits when digital risk spans channels that a domain product does not cover. Social impersonation, fake apps, marketplace fraud, fraudulent ads, dark-web collection and a customer abuse mailbox sit in one platform with automated takedowns. Buyers who want Bolster to start takedowns for Phish and Scam findings without a review by their own team, and who need Threat Graph pivots for coordinated removal, get Bolster's documented workflow. ^{1–16,76–77}

It also suits teams that want managed analysts on the queue. Bolster's SOC coordinates takedowns across jurisdictions, and Bolster uses LLMs for takedown correspondence and follow-up. Bolster also offers Defensive Domain Acquisition suggestions, an MSP multi-tenant console and a documented Scan API with logo detection output. Bolster says it powers Brand Guardian, which Akamai launched, and that its joint work with Akamai on capture from multiple vantage points still has engineering ahead. Bolster is bought on a quote-based contract, and CheckPhish is its related free URL scanner and community tool. ^{1,3,10–16,35,37,41,60,70,92–95}

Where Have I Been Squatted is the better choice#

Pick Have I Been Squatted when your security team works malicious domains and the attacker infrastructure behind them. Lookalikes of your own domains are one way in, and Analyze inspects any other domain on demand. Analysts adopt rules from a maintained library or write their own in the Upsilon query language, and a match can alert, reach Splunk or Microsoft Sentinel, block the domain or request a Takedown. Every request gets an analyst's review before the team reports the domain to its host and registrar. ^{17–21,27–32,34,45–47,55,96–97}

Blocking and exposure checks run in your own stack. Network Enforcement pushes rule-flagged domains to Cloudflare Zero Trust, Zscaler, iboss and Microsoft Defender for Endpoint. Network Intelligence reads Microsoft Defender every 15 seconds and Cloudflare Gateway every minute, so you can see which flagged domains devices on your network reached. ^21–26

Two more products watch your own assets for misuse. Site Canaries flag page loads of your site on hostnames you did not approve, so a copied or proxied page that keeps the script shows up. Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, including sender and URL domains, with the domains you monitor. ^65–68

Domain Monitoring watches your domains continuously, and monitoring, hunting tools, rules and alerts are self-serve with a free trial. Takedowns and the email, network, SIEM and canary products are bought through sales. PDF reports such as the "Domain security overview" and "Compliance readout", and CSV or JSON exports, carry findings outside the platform. Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center, and members sign in through Google, Microsoft 365 or SAML single sign-on with audit logging. End users can add the free Browser Protection extension for Chrome. ^{26–28,32–34,74,83–84,98–100}

Have I Been Squatted does not suit a team that wants one contract for domains, social profiles, apps and marketplace listings. Bolster covers that broader brand-protection remit. ^{1–5,58–59}

FAQ#