Have I Been Squatted vs dnstwister

• Choose dnstwister for a low-cost subscription that emails daily alerts when similar names appear, change IP or gain mail servers, with a free domain check and a keyless public API to try first. ^1–7
• Choose Have I Been Squatted to find malicious domains among your lookalikes, with registration, hosting, port and live-page evidence beyond A and MX records and rules that alert, block or request a Takedown. ^8–17
• Use both if you already depend on dnstwister's API or RSS feeds and want Have I Been Squatted for investigation and response. ^{1,3,7,10–11,15–17}

At a glance#

Have I Been Squatted and dnstwister on the decisions a buyer weighs first.

	Have I Been Squatted	dnstwister
What you get
What you get	Detection and response for malicious domains8	Hosted lookalike search with email alerts1
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context9,18	Permutations checked for A and MX records4,19–20
Scan cadence
Scan cadence	Stated as at least once every 24 hours18	About every 24 hours on a subscription2–4,20
Evidence on a result
Evidence on a result	Registration, DNS, hosting, ports, page evidence10–11	A record, MX flag, country5–6,19,21
After a finding
After a finding	Alerts, SIEM delivery, blocking, annotation, Takedown requests15–17,22–23	Email alerts, RSS, IP mutes2–4
Managed takedowns
Managed takedowns	Analyst-reviewed domain Takedowns24–25	Not found1,26–27
Free lookups
Free lookups	Free ad-hoc lookups28	Free search and keyless API3,5–6
How you buy
How you buy	Self-serve monitoring subscription18,29	Public subscription with published prices1

What each product finds, and what it checks#

dnstwister finds lookalikes by permutation and checks each one for A and MX records. Each search takes one input domain, and generated variants include homoglyphs, inserted characters, common TLD swaps and bitsquatting. Subscriptions repeat that check and alert when a similar name gains an A or MX record. No public documentation of a newly registered domain feed was found. Marketing pages claim a scan of more than a billion SSL certificates, which the subscription and API documentation do not describe. ^{1–4,7,19–20,30–33}

The search returns the first A record, an MX flag and country-level geolocation for each name. From the subscriber dashboard, you can run a WHOIS lookup or check whether a domain is parked. The parked check scores parking likelihood and reports redirects. WHOIS creation dates in alert emails are a beta feature and can be missing. No public documentation of screenshots, isolated browsing, open ports or RDAP was found. ^{1–7,19,21,27,34–36}

Have I Been Squatted adds certificate transparency and newly registered domains beside permutations with named kinds such as homoglyphs, bitsquats and TLD swaps. Each result can carry RDAP registration data, hosting details, DNS records, mail readiness, open ports and a website capture. An analyst can open the lookalike in an isolated browser. Each result takes a status of Owned, Ignored, Malicious or False Positive, and rules and Takedowns skip Owned results. ^{9–14,18,29,37–40}

From an alert to investigation and response#

dnstwister delivers a daily alert and data for your own tools, while Have I Been Squatted carries the finding through investigation, rules and response. On dnstwister, you read an email when a lookalike gains an A or MX record, or pull the same changes from RSS feeds and the subscriber JSON API. Alerts cover new, updated, deleted and new-MX-only domains, with 30 days of alert history. Noise controls mute IPs or CIDR ranges, ignore noisy domains, and mark algorithm-added results as newly monitored for seven days. A management link sits at the bottom of every alert email. ^1–4

Results also leave dnstwister as CSV exports and STIX 2.1 indicator downloads. ^{1–2,27,41–44}

In Have I Been Squatted, the analyst inspects the result's DNS records and website capture, then opens the site in an isolated browser if needed. A Domain rule comes from the maintained library or from the team. It can raise an alert, send the finding to a SIEM such as Splunk or Microsoft Sentinel, block the domain or request a Takedown automatically. Network Enforcement sends flagged domains to gateways, endpoints, mail filters and a hosted domain feed. ^{9–11,13–17,24–25,29,37–40,45–49}

Managed Takedowns report the domain to its host and registrar, with escalation to ICANN and regional CSIRTs where necessary. An analyst reviews every request, and the service stops short of legal action. ^{24–25,29,50}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

How you start with each product#

Both products offer free lookups and a public self-serve subscription. dnstwister's free search needs no account, generates similar names in the browser, resolves each one and exports the results as CSV. A keyless public API offers fuzzing, IP, MX, parked-domain and WHOIS endpoints, and an open-source web app under the Unlicense covers search and exports without alerts. A subscription repeats the A and MX check about every 24 hours. In November 2026, dnstwister's status page reported issues with DNS resolution and delta calculations, and its public IP endpoint returned errors for well-known domains. One-domain subscriptions keep RSS feeds, while larger portfolios get one aggregated email a day and a management API. ^{1–7,19–21,51–55}

Have I Been Squatted runs free ad-hoc lookups and scheduled Domain Monitoring with rules and alerts. The free lookups also run through the MCP server, so an agent can check a suspect domain from a chat client. You buy monitoring through a public per-domain self-serve subscription, with a 14-day free trial. Takedowns and the email, network, SIEM and canary products are bought through sales. The product is hosted, and the twistrs library its permutations are built on is open source under the MIT license. ^{9–10,16,18,28–29,56–61}

Where dnstwister is the better choice#

dnstwister fits when you want lookalike A and MX checks and daily email alerts without standing up a domain-response stack. The free search and keyless API need no account, and the self-serve subscription is low-cost. Its four-week trial needs no credit card and runs twice as long as the 14-day Have I Been Squatted trial. MX-only deltas, IP and CIDR mutes, and the newly monitored flag keep alert noise down. ^{1–3,5–6,29,62–63}

It also suits a buyer who wants to read or run the open-source web app under the Unlicense, or who imports STIX indicators. The public news page records algorithm and incident changes in plain language. That profile matches a brand owner with one domain or a small team that works from email and RSS. ^{1–2,27,41–44,51–52}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when an A or MX record is only the start of deciding whether a domain is malicious. Discovery starts from lookalikes of your own domains. Domain Monitoring adds certificate transparency and newly registered domains to permutations, and Analyze checks any other domain on demand. Each result can carry RDAP registration data, ASN and hosting, open ports, the SMTP banner beside MX records, redirects and a website capture. An analyst can open the site in a live, isolated browser session, and a first-party model classifies each result as legitimate, parked or phishing. ^{8–14,16,18,28–29,56,64–66}

Findings then move into the tools your team already runs. Rules from the maintained library or your own, written in the Upsilon query language over a catalog of 173 domain signals, decide what happens to each result. One rule can raise an alert, send the finding to Splunk, Google SecOps, Elastic Security or Microsoft Sentinel, block the domain in a gateway or endpoint, or request a Takedown. The MCP server and Slack app let agents work the same alerts, and every write needs an admin. ^{10–11,15–17,22–25,28–29,46–49,56–57}

Scripting works on both sides. Have I Been Squatted's Public API streams lookup, analyze and certificate transparency search results as NDJSON, with scoped API keys and a Python SDK. Discover lists unregistered permutations of your domain that could be used for phishing or impersonation. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, while Takedowns and the network, email and SIEM products are added through sales. ^{10,14,18,28–29,56,60,64,67}

Have I Been Squatted does not suit a buyer who must self-host, or whose whole need is low-cost daily email alerts for a few domains. dnstwister covers that job. Have I Been Squatted does not monitor social media, app stores, the dark web, ads or leaked credentials. ^1,61,68–69

FAQ#