Have I Been Squatted vs DNSRazzle

• Choose DNSRazzle when you want a free Apache-2.0 CLI that fuzzes brands with dnstwist, captures viewport screenshots, and scores them against the original with SSIM. ^1–9
• Choose Have I Been Squatted to detect malicious domains and their infrastructure from a hosted service, with no scanner on your host, and to respond through rules, blocks and managed Takedowns. ^{7–8,10–20}
• Use both if you want a local DNSRazzle pass with screenshot scoring, while Have I Been Squatted monitors the brand on a schedule, raises alerts and requests Takedowns. ^{3,7–9,11–12,19–22}

At a glance#

Have I Been Squatted and DNSRazzle on the decisions a buyer weighs first.

	Have I Been Squatted	DNSRazzle
What you run
What you run	Hosted malicious-domain detection and response10	Local Python CLI for lookalike discovery and screenshot comparison1–2
How you get it
How you get it	Self-serve monitoring subscription11,21	Open source and free; install from Git1–6
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context12,21	dnstwist permutations of one or many domains, then DNS resolve1–2
Cadence
Cadence	Scheduled lookups after you add a domain21	One-shot run when you invoke it2,23–24
Page similarity
Page similarity	Favicon fingerprints and shared identifiers7–8	SSIM score on viewport screenshots against the original2,9
After a finding
After a finding	Alerts, SIEM delivery, blocking, annotation, Takedown requests13–14,25–27	CSV files and screenshots on disk1–2,28–29
Mail probe
Mail probe	MX records and SMTP banners, collected by the hosted service8,21	Sends a test email to each lookalike's mail server by default23,29–31
Deeper recon
Deeper recon	Port signals in enrichment7	Optional nmap and dnsrecon reports on selected lookalikes1–2,28,31

A local scan versus continuous monitoring#

DNSRazzle is a pure Python command-line tool for finding and comparing typosquatting, bitsquatting and homoglyph domains for brand impersonation. Install it from Git to run lookalike discovery on your own host without an account. You control when each scan runs and keep its CSV files and screenshots locally. No contractual scan quota appears in the README or the CLI. ^{1–2,5–6,23–24,28–29,32}

A run generates permutations with the pinned dnstwist engine, resolves them, screenshots non-original names that have a usable A record, and writes CSV and PNG output. Pass a single domain, a comma-separated list or a file of domains to cover many brands at once. DNSRazzle also adds a url-encoded-slash permutation that puts 2f in front of the name, aimed at links that hide an encoded slash (%2F). ^{1–3,8,23,28–29,33–34}

Have I Been Squatted is a hosted platform. Domain Monitoring combines generated lookalikes with certificate transparency and newly registered domains. Have I Been Squatted states that lookups run at least once every 24 hours after you add a domain. Ad-hoc Typosquat and Analyze lookups cover one-off checks without standing up a scanner. ^{11–12,21,35–37}

Picture a security engineer who needs a Friday lookalike pass on three brands. With DNSRazzle they install the tool and its browser, point -d or -f at those names, and leave with CSV files and screenshot pairs on disk. With Have I Been Squatted they add the three domains once. Lookups then repeat on a schedule, and new matches arrive as alerts. ^{1–3,11–12,21–23,28–29,32}

Screenshots, similarity and active probes#

DNSRazzle's distinctive check is visual. Playwright captures a 1920×1080 viewport of the original site and of each discovered lookalike with an A record. VisionUtil then computes structural similarity (SSIM) between the converted images. Console labels mark a pair identical at 1.00, similar at 0.90 or above, or different below that, and scores land in domain_similarity.csv. Have I Been Squatted matches favicon fingerprints and shared identifiers such as tag manager IDs. It does not score screenshot similarity against the original site. ^1–3,7–9

A scan that resolves lookalikes also contacts their servers. DNSRazzle sends an HTTP request to port 80 of each lookalike with an A record. For each lookalike with an MX record, it reads the mail server's greeting, and the mx-spy check connects to the lookalike's mail server and sends a real test email through it. No flag turns these probes off without editing the code. Only the -g dry run, which prints permutations without DNS lookups, avoids them. Run scans from a host where that contact is acceptable. ^{1–2,23,28–31}

Optional flags go deeper. -n and -r run nmap -A -sV and a dnsrecon-style report on permutations selected by the screenshot path. A -b blocklist writes IPs and hosts for lookalikes at or above a similarity threshold you set. Screenshot navigation starts from an http:// URL, and DNSRazzle does not try HTTPS first. ^2–3,28,31

Have I Been Squatted brings DNS records, RDAP registration data, hosting details, MX records and SMTP banners, open-port signals, redirects and page content, and screenshots into the hosted result. Use the isolated browser to inspect a live page. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score, and rules decide which findings alert your team. The hosted service collects this evidence, so your team runs no scanner on its own host. ^{7–8,11–13,21,36,38–44}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

What happens after the scan#

DNSRazzle ends when the process exits. Output is files under -o: CSV rows, optional blocklist and recon files, and PNG screenshots. The -e flag can email those CSV files through an SMTP server you configure. No public documentation of a scheduler, run history, suppression list, case status, webhooks, SIEM connectors or managed takedowns was found for DNSRazzle. ^{1–2,23–24,28–29,45}

Have I Been Squatted keeps the workflow after discovery. Rules from a maintained library or your own logic can raise an alert, deliver a finding to a SIEM, push a domain to Network Enforcement or request a Takedown. Connectors cover named SIEMs, gateways, mail filters, Slack, webhooks and an MCP server. An analyst reviews every managed Takedown and reports the domain to its host and registrar. ^{11,13–20,25,35,37,46–49}

Say a lookalike of your login host appears with a page that looks like yours. In DNSRazzle, a high screenshot-similarity score can put that lookalike into a blocklist file for your own response workflow. In Have I Been Squatted, a domain that matches a configured rule can raise an alert, go to a gateway feed or start a Takedown request. Choose based on whether you want to maintain that response workflow yourself. ^{2,9,13–20,25}

Where DNSRazzle is the better choice#

DNSRazzle fits when cost, control and a focused local workflow matter more than a hosted queue. Choose it when you want to inspect or change the scanner's code and keep its output in your own workflow. It is free and licensed under Apache-2.0. Conference talks from Baxter Healthcare and Health-ISAC show an enterprise team using it for brand impersonation detection. ^{1–6,50–51}

Pick it when you want SSIM scores on viewport screenshots, optional nmap and dnsrecon depth, a blocklist file with a set threshold, or many brands in one local run. It also runs an mx-spy probe that connects to each lookalike's mail server, sends a test message and flags the servers that accept it. The results stay on disk, which suits operators who want local files and already manage scheduling and follow-up. ^{1–3,7–9,23,28–31}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when you want to detect malicious domains and the infrastructure behind them without sending probes to lookalike servers from your own network. The hosted service gathers DNS records, RDAP registration data, hosting, MX records and SMTP banners, open ports, redirects and screenshots for each lookalike, where available. A first-party model labels each result legitimate, parked or phishing. When a lookalike serves a page, an analyst can open it in a live, isolated browser session instead of a local browser. ^{7–8,10,12–13,21,36,42–44}

Discovery and follow-up keep running after the first pass. Domain Monitoring watches each domain you add continuously and adds certificate transparency and newly registered domains to generated permutations. Alert statuses record what your team has already reviewed. Rules from the maintained library, or your own in the Upsilon query language, can notify Slack or a webhook, send the finding to a SIEM, block the domain or request an analyst-reviewed Takedown. ^{7–8,11–14,19,21–22,25–27}

Your own systems add evidence that no name scan sees. Site Canaries flag a copy of your site when one of its pages loads on an unrecognized hostname. Rule-flagged domains can go to Network Enforcement or a hosted domain feed for blocking. Network Intelligence reads Microsoft Defender and Cloudflare Gateway traffic counts, so you can see whether devices on your network connected to a flagged domain. ^{14–16,52–54}

A team that scripts its checks can call the Public API, which streams lookalike, unregistered-name, analysis and certificate transparency search results as NDJSON under scoped API keys, with a Python SDK. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, so a small team can start without installing Python, Playwright and nmap. Takedowns and the blocking, email and SIEM products are added through sales. ^{7,11,21,35–37,54–56}

Have I Been Squatted does not suit a buyer whose decision rests on SSIM screenshot scores, or who wants the scanner and its output to stay on their own host. DNSRazzle does that job for free. A buyer who only needs an occasional check can use the free Analyzer and the ad-hoc Typosquat and Analyze lookups without a subscription. ^{1–3,5–9,11,35–37,56–57}

FAQ#