Have I Been Squatted vs DomainTools

• Choose DomainTools for multi-year infrastructure investigations, or for keyword-based lookalike monitoring with Iris Detect and Domain Risk Score. ^1–10
• Choose Have I Been Squatted to detect malicious domains starting from lookalikes of your own, open suspect pages in a live, isolated browser session, and let one rule block a domain and request its Takedown. ^11–27
• Use both when you need DomainTools' historical investigations alongside Have I Been Squatted's domain monitoring, response rules and managed Takedowns. ^{1–6,12–13,17–20,26–27}

At a glance#

Have I Been Squatted and DomainTools on the decisions a buyer weighs first.

	Have I Been Squatted	DomainTools
What you get
What you get	Detection and response for malicious domains11	Iris Investigate, Iris Detect, Iris Enrich and DNSDB28
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context13–14	Keyword monitors over newly detected domains7–9
Risk scoring
Risk scoring	Legitimate, parked or phishing, with confidence14,17–19,29	Domain Risk Score, 0 to 100, rescored daily10,30
Website evidence
Website evidence	Screenshots and a live isolated browser15–16	Landing-page screenshots, daily for watched domains5,28,31–32
Response
Response	Rules alert, block, annotate and request Takedowns17,20–21,33–34	Block tag or Google Web Risk escalation35–38
Investigation depth
Investigation depth	Atlas pivots on recent observations (early access)39–42	Pivot Engine across IPs, registrants, name servers and certificates2,43–44
Historical data
Historical data	Atlas observations from the last 30 days39	WHOIS, hosting and decade-plus passive DNS history3–6
How you buy
How you buy	Self-serve monitoring subscription12,14	Quote-based contract28

Finding lookalike domains#

Iris Detect starts from a keyword, and Have I Been Squatted starts from your domains. In Iris Detect, you create a monitor for each term you want to protect, and Detect matches that term against domains that passive DNS newly detects, in near real time. A Previous group holds matches that were active before the monitor existed, and DomainTools described its launch method as comparing global new domain registrations with brand terms. ^1,7–9

Matching runs in exact, full domain, fuzzy, Internationalized Domain Name and variation modes. DomainTools documents 15 named variation algorithms, from homoglyphs and bitflips to prefixes and suffixes. Short brand names need care. Variation matching needs a term of four or more characters, and DomainTools does not recommend it for terms of six characters or fewer. Text and name server exclusions cut noise from common terms. ^9,36,45–46

New matches land in the New group. An analyst watches a match to track changes in its hosting IP, mail servers, name servers and registrar, with one screenshot a day, then escalates it or ignores it as a false positive. Email alerts are configurable. ^{7,9,35–36,45,47}

Have I Been Squatted starts from the domains you add, one at a time or by CSV import. Domain Monitoring generates lookalike permutations of each domain, with named kinds such as homoglyphs, bitsquats and TLD swaps, and also finds lookalikes in certificate transparency and newly registered domains. Business context lets agents suggest further lookalikes, and a suggestion becomes a result only when it resolves. There are no keyword or permutation lists to maintain, and Discover finds unregistered permutations that someone could still register. ^{12–14,16,18–19,48–49}

Have I Been Squatted looks up each monitored domain at least once every 24 hours. An analyst marks each result Owned, Malicious, Ignored or False Positive, and rules and Takedowns skip Owned results. ^13–14

Choose Iris Detect when you want to write keyword monitors for brands, public figures, geopolitical events or partner names. Choose Have I Been Squatted when you want lookalikes generated from the domains you own. ^1,13–14,48

Scoring and the evidence you inspect#

DomainTools rates each domain with Domain Risk Score, from 0 to 100. The overall score is the highest of four components. These are proximity and three Threat Profile models for phishing, malware and spam. The Threat Profile models apply only to domains 28 months old or younger. DomainTools states that provisional proximity and phishing scores arrive within minutes and the full score within 15 to 25 minutes, and it rescores domains daily. DomainTools recommends 70 to 89 as the default threshold for significance. ^10,30

Iris Detect shows the score beside WHOIS, IP, name server and mail server panels and a landing-page screenshot. Detect takes a screenshot on first discovery and once a day for watched domains. ^{2,4–5,7,9,28,31–32,35–36,47,50–51}

Have I Been Squatted classifies each result and shows the evidence behind it. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score. Each result can also carry RDAP registration data, hosting details, DNS records, mail readiness, open ports and a website capture with redirects, HAR, DOM and page semantics. An analyst can open a lookalike in a live isolated browser, then write rules over those signals. The rule author sets each rule's severity and its score from 0 to 100. ^{13–20,29,52}

No public documentation of live isolated browsing, open-port scanning, HAR or DOM capture, or rules that act automatically on Iris Detect results was found. DomainTools offers IrisQL for search in Iris Investigate, and Detect alerting runs through email and pull APIs. ^{1,5,9,28,31–32,36,45,50,53}

Acting on a finding#

DomainTools sends a finding toward browser blocklists and your SOC tools. Iris Detect escalates a domain as a Block tag for API consumers, a Google Web Risk submission, or both. If Google deems the domain malicious, Chrome blocks it, and Safari and Firefox follow Google. Each submission shows Pending, Completed or Closed. No current public documentation of a managed takedown service that reports to hosts and registrars was found, although a 2024 UK G-Cloud reseller price list included a DomainTools Takedown Service. ^7,35–38

The Block tag is a signal for scripts or a SOAR playbook to act on. The Detect API is pull only, and its new and watched domain endpoints accept one query an hour each. Detect apps for ServiceNow, Splunk, ThreatStream and Cortex XSOAR bring results into those tools, beside a long SIEM, SOAR and TIP catalog for Iris. Threat Feeds deliver domain and IP risk scores and hotlists through APIs, download and RPZ. ^{1,35–36,44,47,54–60}

Have I Been Squatted runs response from rules over domain signals. A maintained library covers common detections, and your team can add its own rules. You connect the tools you run, then choose the actions for each rule. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list, annotate the result with a status such as Malicious, or request a Takedown. Network Enforcement sends flagged domains to gateways such as Cloudflare Zero Trust and Zscaler, to Microsoft Defender for Endpoint and to mail filters. It also serves a hosted domain feed that other tools poll, in seven formats such as STIX 2.1, CSV and AdGuard, with documented MISP setup. Monitored domains and their subdomains are never blocked. ^{12,17–25,33–34}

Managed Takedowns start from a rule or from an admin's request on a result or alert. An analyst reviews every request. The team reports the domain to its host and registrar, and escalates to ICANN and regional CSIRTs where necessary. The case record tracks each step through provider notification and completion, with analyst notes. ^{12,26–27,61}

Choose DomainTools when browser blocklists, threat feeds and SOC playbooks are your response path. Choose Have I Been Squatted when one finding should drive an alert, a gateway block and a host or registrar Takedown. ^{12,17,20–21,26–27,35,37,54,60–61}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

Investigating shared infrastructure#

DomainTools has the deeper investigation tools and the longer archive. In Iris Investigate, the Pivot Engine follows shared IP addresses, registrants, name servers, SSL certificates and more, with guided and historical pivots, IrisQL search, collaboration and reports. DomainTools states that Iris draws on over a decade of historic DNS data through Farsight DNSDB, plus WHOIS and hosting history. ^{1–6,43–44,53,62–63}

An analyst can start from one domain, walk its registration and hosting records back through the years, then export indicators or write a report. Detect sends a selected domain straight into Iris Investigate, or exports it to CSV or STIX 2.0. DomainTools also hosts an MCP server with Iris Investigate, DNSDB and Domain History tools for AI agents. ^{2–3,28,35,53,63–64}

Have I Been Squatted takes a monitored result further with Atlas investigations, in early access. An investigation starts from a hunt you describe and any suspect domains you already have, pivots across shared infrastructure in Atlas, its store of domain observations, and keeps watching after the first pass. An admin can add IP addresses, nameservers, favicon hashes or identifiers for it to pivot on. Results appear in views such as Tree, Table, Clusters and Flows, and an investigation exports to STIX 2.1, CSV or JSON. ^{27,39–42,65–66}

The observations that feed Atlas pivots come from the last 30 days, and Have I Been Squatted records current DNS records but does not collect passive DNS history today. Atlas suits recent lookalike cases, while DomainTools covers campaigns that need years of registration and DNS history. ^{3–6,12–13,18–19,39,42,67–68}

Both products also serve AI agents. The Have I Been Squatted MCP server covers lookups, monitoring queries, rules, alerts, Takedowns, response dispatch, result annotation and documentation search, and every write needs an organization admin. ^{48,65,69–71}

Where DomainTools is the better choice#

DomainTools fits when investigation depth is the job. Teams that map adversary infrastructure across years of WHOIS, hosting and passive DNS history get a mature Pivot Engine workflow with more than ten data panels, plus DNSDB. DomainTools sells Iris to SOC, anti-fraud and brand-protection teams. Iris Detect adds keyword monitoring with documented variation algorithms and fast Domain Risk Score triage. Integrations and threat feeds with RPZ delivery put its results into the tools those teams already run. Buying is through a quote-based contract. ^{1–6,9–10,28,30,45,53–55,59–60,63}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when your team wants each malicious domain it finds to end in a response. Lookalikes of the domains you add are one way in, and Domain Monitoring watches for them continuously with no keyword or permutation lists to maintain. Analyze checks any other domain on demand. One rule, from the maintained library or written by your team, can raise an alert and block the domain in Zscaler, Microsoft Defender for Endpoint or Cloudflare Zero Trust. The same rule can request a Takedown, which an analyst reviews before the team reports the domain to its host and registrar. ^{11–14,16–27,48,61,69,72–73}

Have I Been Squatted also checks your own telemetry and pages. Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, including sender and URL domains, with the domains you monitor. Network Intelligence reads Microsoft Defender every 15 seconds and Cloudflare Gateway every minute, showing which domains devices on your network reached. Site Canaries flag copies of your own pages served from hostnames you do not recognize, and end users can add the free Browser Protection extension for Chrome. ^{12,20,74–79}

Monitoring, hunting tools, rules and alerts start self-serve with a free trial, and Takedowns and the email, network, SIEM and canary products are added through sales. For a security review, Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center. ^{12,14,16,48,69,76,80}

Have I Been Squatted does not suit a buyer whose first need is a multi-year infrastructure archive with Pivot Engine and DNSDB. DomainTools covers that remit. ^{1,3–6,39,63}

FAQ#