Have I Been Squatted vs dnstwist

• Choose dnstwist when you want a free Apache-2.0 scanner you can read, change and run locally, with a wide fuzzer set and optional page-similarity and MX checks in one command. ^1–8
• Choose Have I Been Squatted to detect malicious domains and their infrastructure, with lookalike discovery that adds certificate transparency and newly registered domains to permutations, and rules that alert, block or request a Takedown. ^5–6,9–17
• Use both when Have I Been Squatted watches your portfolio and you still want dnstwist for local fuzzing or HTML and screenshot similarity scores. ^{3–6,10–11}

At a glance#

Discovery, investigation and ongoing operation in each tool.

	Have I Been Squatted	dnstwist
Operating model
Operating model	Continuous monitoring with automated lookups and alerts10–11	One-shot run; you own storage and scheduling4
Deployment and control
Deployment and control	Hosted service18	Self-hosted Apache-2.0 code, no account1–3
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context11–12	Fuzzes one domain per run and resolves each name3–4,19
Page similarity
Page similarity	Favicon fingerprints and shared tracking IDs5–6	HTML fuzzy hashes and screenshot perceptual hashes3–6
Mail readiness
Mail readiness	MX records and SMTP banner6,12	MX records plus --mxcheck SPYING-MX probe4,7–8
Rules and response
Rules and response	Alerts, SIEM delivery, blocking, annotation, Takedown requests13–17	Not found: Not found3–4
Free quick check
Free quick check	Free ad-hoc lookups20	Free no-login page at dnstwist.it21
How you get it
How you get it	Self-serve monitoring subscription10,12	Open source and free2–3

One command versus a watched portfolio#

dnstwist scans one domain each time you run it. Have I Been Squatted watches every domain you add and keeps what it finds. dnstwist is a domain name permutation engine for detecting homograph phishing attacks, typosquatting, fraud and brand impersonation. Marcin Ulikowski maintains it as an Apache-2.0 Python CLI, with a Python API, a Docker image and a free no-login page at dnstwist.it. Each run generates permutations of one domain and resolves each name. ^{1–4,10–11,19,21–23}

You can tailor how dnstwist generates candidates. The fuzzer set covers typo-family edits, QWERTY, QWERTZ and AZERTY keyboard layouts, bitsquatting, and homoglyph and Cyrillic IDN rules with per-TLD glyph sets. Dictionary and TLD files add keyword combinations and TLD swaps. ^3–4,24

Have I Been Squatted is a hosted product. Domain Monitoring combines generated lookalikes with certificate transparency and newly registered domains, and keeps results between lookups. Have I Been Squatted states that lookups run at least once every 24 hours after you add a domain. Its permutations are built on twistrs, an MIT-licensed Rust library whose README credits dnstwist directly and sets out to port it. No public documentation of a newly registered domain feed or certificate transparency monitoring was found for dnstwist. ^{3–5,7,10–12,18}

Picture a security engineer who owns acme.com. With dnstwist they install the CLI, run a scan, export CSV or JSON, and decide what to keep. With Have I Been Squatted they add the domain once, then review new matches as scheduled lookups land. The default dnstwist output lists every permutation, and a run with --registered lists each name that returned DNS data, with its fuzzer type and records. A lookup failure prints as !ServFail and stays in that list, so a listed name does not prove that the domain is registered. ^{3–4,7,10–11,19,25}

$ ./dnstwist.py -r github.com
permutations: 92.94% of 2167 | found: 139 | eta: 0m 00s | speed: 775 qps

replacement    githuh.com      97.107.140.81 NS:dns1.registrar-servers.com
subdomain      gith.ub.com     18.224.45.92
transposition  gihtub.com      !ServFail !ServFail NS:!ServFail
transposition  githbu.com      64.32.8.68 NS:ns1.dnsnuts.com MX:mail.h-email.net
various        githubcom.com   199.59.243.222 NS:ns1.bodis.com
vowel-swap     gethub.com      203.242.255.30 NS:ns.ktnet.co.kr

History, alerts and response after the scan#

dnstwist hands its results to your own pipeline. It exports CSV, JSON or a bare name list, and the Python API returns the results as a list of dictionaries. You supply scheduling and storage, because the tool keeps no monitoring state between runs. A third-party guide from Pi Stack wraps the CLI in a daily cron script that alerts on new domains. No public documentation of alert delivery, case state, a suppression list or managed takedowns was found. ^{3–4,7,26–27}

Have I Been Squatted keeps the case open. Domain Monitoring saves results across lookups, and rules from a maintained library or your own logic raise alerts with statuses such as Active, Resolved, Ignored and False Positive. Digests can run daily, weekly, monthly or off. A rule can deliver a finding to a SIEM, push a domain to Network Enforcement, mark each matched result Malicious with a note, or request a Takedown. Connectors reach named SIEMs, gateways, mail systems, Slack, webhooks and an MCP server for agent workflows. ^{10–11,13–17,20,28–37}

An analyst reviews every Takedown request. The team reports the domain to its host and registrar, then escalates to ICANN and regional CSIRTs where necessary. The service stops short of legal action. ^10,38–40

Back to the engineer with acme.com. After dnstwist they own the diff between today's CSV and last week's, the alert that emails the team, and the ticket that asks a registrar to act. After Have I Been Squatted they open a new match, mark false positives, and let a rule notify Slack or request a Takedown from the same case. ^{3–4,7,11,13–15,27–28,33,38–39}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

What each tool checks after a hit#

dnstwist can compare a candidate site with your real site and report a similarity percentage. --lsh compares page HTML with ssdeep or TLSH fuzzy hashes, and --phash compares screenshots. Optional flags add WHOIS creation date and registrar, HTTP and SMTP banners, country-level GeoIP and an --mxcheck probe that can flag SPYING-MX. Screenshot comparison needs Chromium, Selenium and Pillow, and --screenshots can save the PNG files to disk. ^3–8,23

Those local checks are a real strength. Have I Been Squatted does not compute or offer HTML or screenshot similarity percentages today. It fingerprints favicons and matches shared tracking IDs instead. The dnstwist README warns that fuzzy-hash scores are unlikely to reach a full match even for man-in-the-middle frameworks, and that a phishing site can use completely different HTML. Have I Been Squatted records each lookalike's MX records and SMTP banner, which show whether it is set up for email, but runs no interception probe like --mxcheck. That probe does not read the RCPT TO reply, so SPYING-MX does not confirm that the host accepts mail for the permutation. ^3–8,12

Have I Been Squatted keeps the evidence with each monitored result. A lookalike can carry RDAP registration data, hosting details, DNS records, mail readiness and open ports. Page evidence covers redirect chains, HAR and DOM capture, page semantics and automatic screenshots, and an analyst can open the site in a live isolated browser session. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score, beside the scores your rules assign. ^{5–6,10–13,41–48}

If you need a percentage that compares a live page to your real site from your own laptop, dnstwist is ahead today. If you need registration, hosting, DNS and page evidence kept on the same result your rules act on, Have I Been Squatted fits better. ^{3–6,13–14}

Where dnstwist is the better choice#

dnstwist fits when you already own scheduling and response, or when you want full local control of the scan. It is open source and free, self-hostable, and needs no account or quota. You can read the code, tune threads and resolvers, and export CSV, JSON or a bare list into tools you already run. The fuzzer set is wide, and Have I Been Squatted offers no page-similarity percentages and no interception probe like --mxcheck today. For a browser check with no install, dnstwist.it needs no login. ^1–8,21

That profile suits a security engineer, an independent researcher, or a small team that already stores results and routes alerts. The maintainer reports that tens of SOC and incident response teams use the scanner, and the README lists integrations in other products, among them a Splunk add-on and Maltego. The maintainer also calls it useful as an additional source of targeted threat intelligence. ^1,3–4,25

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when the goal is to detect malicious domains and the attacker infrastructure behind them, then respond, without building the scheduler, result store and diff yourself. Lookalikes of your own domains are one way in. Domain Monitoring watches each domain you add continuously and keeps results between lookups, finding lookalikes in certificate transparency logs and newly registered domains as well as permutations. The Analyzer checks any other domain on demand with no login, and Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, including sender and URL domains, with the domains you monitor. ^{5,9–12,20,34,47,49–53}

A match also arrives with its evidence and a next step. Each result can carry RDAP registration data, hosting, DNS records, mail readiness and open ports, plus a legitimate, parked or phishing classification from a first-party model. When a lookalike serves a page, an analyst can open it in a live, isolated browser session. Rules come from the maintained library, or your team writes them in the Upsilon query language. A rule can raise an alert, notify Slack or a webhook, send the finding to a SIEM, block the domain or request an analyst-reviewed Takedown. Managed Takedowns go after the infrastructure itself, with the team reporting each domain to its host and registrar. ^{5–6,10–17,38–42,47–48}

Scripting does not stop when you switch. The Public API streams NDJSON results for lookalike lookups, unregistered permutations, domain analysis and certificate transparency search, with scoped API keys and a Python SDK. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, and Takedowns and the blocking, email and SIEM products are added through sales. ^{5,10,12,20,34,47,50,54–55}

Have I Been Squatted does not suit a buyer who must run monitoring, enrichment and rules on their own machines with no vendor account. The MIT-licensed twistrs library its permutations are built on does run locally, but the service around it is hosted. Have I Been Squatted does not monitor social media, app stores, the dark web or ads. For a one-off check, either tool may fit. Choose dnstwist when you need a complete local scanner, custom fuzzing or page-similarity percentages. ^{1–6,18,20,56–57}

FAQ#