Have I Been Squatted vs CIRCL Typosquatting Finder

• Choose Typosquatting finder for a free, no-account browser scan with MISP export, or CIRCL's open-source ail-typo-squatting library when you want to generate variations yourself and write YARA, regex or YAML rules for other tools. ^1–8
• Choose Have I Been Squatted to keep watching continuously for malicious domains, starting from lookalikes of your domains, with RDAP, hosting and website evidence on each result where available. ^9–17
• For a one-off check, Have I Been Squatted also offers free Typosquat and Analyze lookups, and its Analyzer checks any domain with no login. ^{10,13,17–21}
• Use both when CIRCL covers a quick assessment or a local generation pass, and Have I Been Squatted owns continuous monitoring, triage and response for your brand domains. ^{2,6–7,10–11,22}

At a glance#

Discovery, investigation and response in Have I Been Squatted and Typosquatting finder (CIRCL).

	Have I Been Squatted	Typosquatting finder (CIRCL)
Primary job
Primary job	Detection and response for malicious domains9	Free hosted scan of one domain2,23
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context11–12	Generate variations of one domain, then resolve them1–2,6,24–25
Schedule and history
Schedule and history	Scheduled lookups12	One scan per request24,26–27
Website evidence
Website evidence	Screenshots and an isolated browser session16–17	Page-text similarity and resource difference23–24,27–28
Alerts and rules
Alerts and rules	Library and custom rules that raise alerts10,22	Exclude list and known NS or MX marks2,23–24,26,29
Export into other tools
Export into other tools	SIEM, block lists, Slack, webhooks and an MCP server30–31	Native MISP feed and JSON, plus AIL tracker3–5
Response
Response	Managed Takedowns with analyst review32–33	Not found1–2,6,26
Access and licensing
Access and licensing	Self-serve monitoring subscription10,12	BSD-2-Clause library, Apache-2.0 website, self-hostable7,26,34–35

A free one-shot scan versus continuous monitoring#

Typosquatting finder by CIRCL is built for a quick assessment. CIRCL describes it as a free and public service to find typosquatted domains, and the hosted scan needs no account. You enter one domain, optionally pick algorithms, and get a result table with permutations, IP addresses, name servers, mail servers, page titles and page-similarity fields. The open-source library behind it, ail-typo-squatting, generates variations and can resolve them from your own machine. ^{1–2,6–7,23–25}

Each hosted scan is a single request. No public documentation of a scheduler, recurring monitoring or durable investigation history was found for the service. A shared session lasts one hour, so download the variation list, the JSON of identified domains or a MISP event if you need to keep the results. CIRCL also warns that results might include false positives that are legitimate similar names. ^{1–2,23–24,26–27}

Have I Been Squatted runs Domain Monitoring as an ongoing watch. It generates lookalikes and also watches certificate transparency and newly registered domains. Have I Been Squatted states that lookups run at least once every 24 hours after you add a domain. Free ad-hoc Typosquat and Analyze lookups cover one-off checks without a monitoring subscription. ^{10–12,17–19}

A CIRCL scan tells you which variants resolve today. Have I Been Squatted keeps looking after that first scan and surfaces lookalikes that appear later. Its rules then decide whether a finding raises an alert, blocks the domain or requests a Takedown. ^{10–11,22,30,32–33,36}

How each tool finds and enriches lookalikes#

CIRCL's library ships a broad, configurable permutation engine. It lists 21 algorithms, including common misspellings, homophones, numeral swap, singular and plural forms, and dynamic-DNS suffix generation. Both TLD algorithms read a bundled IANA list of 1,441 TLDs, and the wrong-TLD algorithm also adds public-suffix second levels. ^{2,6,8,25–26,37–43}

The hosted service takes one domain per scan. The library CLI accepts several domains or a file, which suits bulk runs. Both resolve A, AAAA, NS and MX records, and the library adds an optional catch-all test per variation that flags wildcard DNS. ^{1–2,6,24–25,44}

On resolving names, the website software behind the hosted service fetches each page and keeps its title. It can compare page text and resource differences against the original site, and combine them into a similarity ratio when that check is enabled. The hosted service adds a GeoIP country from CIRCL's own lookup. No public documentation of certificate transparency monitoring, a newly registered domain feed, WHOIS or RDAP, or screenshots was found for Typosquatting finder. ^2,6,24–28

Have I Been Squatted combines generated lookalikes, including homoglyphs, bitsquats, keyword swaps and TLD changes, with certificate transparency and newly registered domains. For each result, RDAP registration data where available, plus ASN and hosting details, helps you investigate ownership and infrastructure. MX and SMTP signals show whether a domain is set up for email, and port scans show which services it exposes. Automatic screenshots, redirect and HAR capture, and a live isolated browser session support website inspection. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score, and rules can act on those scores. ^{11–17,22,45}

Choose CIRCL's library when you want to generate variations locally and change the algorithms. Its website software adds page-text and resource comparisons when that check is enabled. Choose Have I Been Squatted when you need certificate transparency and newly registered names beside permutations, with screenshots and registration records where available. ^{7–8,11–17,24,26–27,34–35,37–40}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

What happens after you have a list of lookalikes#

CIRCL is strongest when another system owns the rest of the workflow. The hosted service exports a variation list, JSON of identified domains, a MISP feed and MISP JSON, with object templates in the MISP library. The library writes text, YARA, regex and YAML per domain so other tools can watch those strings. AIL's typosquatting tracker calls the library's runAll() and stores the variation list. ^{2–6,8,23,26}

The library README shows the YARA rule shape, abbreviated here to three of its twelve strings. ^6,8

rule ail-project_org {
    meta:
        domain = "ail-project.org"
    strings:
        $s0 = "ail-project.org"
        $s1 = "il-project.org"
        $s2 = "al-project.org"
        // ... nine more variants
    condition:
         any of ($s*)
}

No public documentation of hosted alerts, webhooks, chat or ticketing connectors, or blocking controls was found for Typosquatting finder. The service can mark excluded domains and known NS or MX names, and those marks stay on the scan results. To act on a finding, route the MISP export or the library output into the tools your team already runs. ^{2–6,23–24,26,29,46}

Have I Been Squatted keeps the case after discovery. A maintained rules library and your own rules run over domain signals. A rule can raise an alert, deliver a finding to a SIEM, push a domain to Network Enforcement or request a Takedown, and an analyst reviews every Takedown request. An MCP server and Slack app let agents work the same surfaces. Every write needs an admin, and Slack writes wait for Approve or Deny. ^{10,18–19,22,30,32–33,36,47–51}

Where Typosquatting finder is the better choice#

Typosquatting finder fits a security engineer, a CSIRT analyst or a small team that already runs its own scheduling, history and response. The hosted service gives a free assessment in the browser with no account. The library is BSD-2-Clause and the website software is Apache-2.0, so you can self-host both and change the code. CIRCL, the CERT for the private sector, communes and non-governmental entities in Luxembourg, operates the service, and the library acknowledges EU co-funding. ^{1–2,6–7,26,34–35,52–53}

The library's permutation set covers misspellings, homophones, numeral and plural forms, dynamic-DNS suffixes and a wide TLD swap, with a catch-all test per variation. The website software combines page-text similarity and resource difference into a ratio against the original site. Native MISP export and YARA, regex or YAML outputs feed CSIRT tooling, and AIL can track the generated list. The download tracker pypistats counted 49,109 PyPI downloads of the library over one month, a figure that includes mirrors and CI. ^{3–6,8,24,27,37–42,44,54}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when a malicious domain that appears next month matters as much as the variants that resolve today. Lookalikes of your own domains are the starting point. Domain Monitoring watches continuously and adds certificate transparency and newly registered domains to generated permutations, so a name that never came up in a one-off scan can still surface. Discover lists permutations that are still unregistered and could be used for phishing or impersonation, and rules raise an alert when a new result matches. ^{9–13,17,19,22}

Triage starts from a full record for each result. RDAP registration data, ASN and hosting, mail readiness, open ports and a website capture arrive with it where available, and a first-party model classifies it as legitimate, parked or phishing. One rule, from the maintained library or your own, can then alert, send the finding to a SIEM, block the domain or request a Takedown that an analyst reviews. ^{11–17,22,30,32,36,45}

Your own tooling can still pull the results. The Public API streams lookup, analyze and certificate transparency search results as NDJSON, with scoped API keys and a Python SDK. A hosted domain feed publishes rule-flagged domains in seven formats, among them STIX 2.1 and CSV. Its documentation covers MISP setup, so a MISP instance can keep consuming what Have I Been Squatted finds. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, while Takedowns and the network products, including the domain feed, are added through sales. ^{10,12–13,17–20,48,55–56}

Have I Been Squatted is a hosted product. Its permutations are built on twistrs, an open-source Rust library under the MIT license, but monitoring, enrichment and response run in the hosted product. CIRCL's library and self-hosted website serve you better if you must run the scan and web checks on your own servers. They also suit a team that wants a Python generator feeding MISP and AIL. Have I Been Squatted also does not monitor social media, app stores, the dark web, ads or leaked credentials. ^{3–7,13,26,34–35,57–59}

FAQ#