Have I Been Squatted vs Fortra Brand Protection (PhishLabs)

• Choose Fortra Brand Protection when you want a managed service that watches domains, social media, mobile apps, the dark web and executives, with analysts validating findings and running takedowns. ^1–13
• Choose Have I Been Squatted when your team investigates malicious domains and attacker infrastructure itself, in a live, isolated browser session, and sends blocks to Zscaler, Cloudflare Zero Trust or Microsoft Defender for Endpoint. ^14–24
• Use both if Fortra Brand Protection runs your wider brand program and your security team wants domain rules in its own stack, with one product owning domain triage and takedowns. ^{1–8,15–16,18–27}

At a glance#

Have I Been Squatted and Fortra Brand Protection on the decisions a buyer weighs first.

	Have I Been Squatted	Fortra Brand Protection
What you get
What you get	Detection and response for malicious domains14	Managed brand protection with Domain Monitoring10
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context28–29	Brand-tied domains and likely variants from passive DNS, WHOIS and SSL data9–10,12
Alert triage
Alert triage	Customer alert statuses and digests29–30	Analyst validation before escalation9–11
Response in your tools
Response in your tools	Rule alerts, SIEM events, blocks, Takedown requests19–20,31–33	Feeds and reporting APIs into SIEM and SOAR categories34
Managed takedowns
Managed takedowns	Domains25,35–37	Domains, social profiles and mobile apps2,34,38–39
Beyond domains
Beyond domains	Not covered: social, apps, dark web40–41	Social, apps, dark web, credentials, executives1–8
How you buy
How you buy	Self-serve monitoring subscription25,28	Quote-based contract42–44

How each product investigates a lookalike domain#

Fortra Brand Protection, formerly PhishLabs, builds detection that feeds its analysts. Fortra says Domain Monitoring correlates passive DNS, WHOIS, SSL certificate data and domain activity to find suspicious domains tied to the brand and to anticipate likely variants. Fortra states that it covers more than 2,000 TLDs and analyzes over 350 million URLs daily. Screenshots and threat URLs are captured when available. Analysts validate results to remove false positives before escalation, and confirmed malicious domains stay under monitoring for changes. ^{9–13,34,38,45–49}

Have I Been Squatted gives your analysts the domain evidence to inspect. Discovery combines generated lookalikes (named kinds include homoglyphs, bitsquats and TLD swaps) with certificate transparency and newly registered domains. Results can include RDAP registration data, hosting details, DNS records, mail readiness, open ports and a capture of the website. Have I Been Squatted records current DNS records but does not collect passive DNS history today. An analyst can check whether a lookalike resolves, is set up for email or serves a copied page, then open it in an isolated browser. ^{15–18,25,28–29,50–54}

The difference is who judges the domain. Fortra's analysts validate detections before they reach your team. With Have I Been Squatted, your team reads the evidence and sets the response, analysts review every Takedown request, and a Managed Threat Intelligence service is available through sales. ^{9–11,15–16,19–20,25,35}

The same split applies to related infrastructure. Fortra states that its analysts pivot from a detection to related threat infrastructure as part of the service. No public documentation of a customer-facing graph or clustering tool was found. ^8,55

Have I Been Squatted gives your team that pivot as Atlas investigations, in early access. An investigation starts from a described hunt, optionally with domains you already suspect, and follows shared infrastructure through Atlas, the store of domain observations, then keeps watching for new matches. Results show in views such as Tree, Table, Clusters and Flows, and export as STIX 2.1, CSV or JSON. Analyze adds a one-off check of any domain, and signed-in users can also check a single page by its URL in the dashboard, through the API or through the MCP server. ^{16,27,36,53–54,56–61}

Coverage beyond lookalike domains#

Fortra Brand Protection lets a brand or fraud team send domain abuse, social impersonation, fake apps and exposed credentials to one managed service. Its analysts run mitigation, with takedowns at registrars, hosts, social platforms and app stores. Coverage also includes the open web, the dark web, counterfeit activity, executive exposure and source-code leaks. Fortra positions the service for highly targeted enterprises and businesses, with a visible financial-services focus. ^{1–8,10–11,13,34,38–39,62–63}

Have I Been Squatted concentrates on domains and the threats built on them. Domain Monitoring generates lookalikes and watches certificate transparency and newly registered domains. Email Intelligence adds mail telemetry from Microsoft 365 and Google Workspace, and Site Canaries flag copies of your own pages. Have I Been Squatted does not monitor social media, app stores, the dark web, ads or leaked credentials. ^{25,28–29,40–41,64–66}

Acting on a finding in your own tools#

Fortra Brand Protection routes findings through a client web app with an executive dashboard, incident management, workflows, reporting and analytics. Reporting APIs cover threat intelligence indicators, incident data and incident creation, and feeds reach APIs, SIEMs, SOARs, TIPs, firewalls and identity providers. Fortra states that feed indicators arrive within minutes of attack detection. Threat-Specific Workflows let customers fine-tune mitigation. No public documentation of a customer rule engine was found. ^1,8,12,34,67

Have I Been Squatted puts response in rules that run over domain signals. A maintained rules library covers common detections, and your team can add its own rules. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list, mark the result Malicious with a note or request a Takedown. An analyst can also send one response for one result now, outside any rule. ^{15–16,19–20,25,27,31–33}

Network Enforcement sends flagged domains to gateways, endpoints, mail filters and a hosted domain feed. An MCP server lets agents work the same alerts and Takedowns, and every write needs an admin. Before you choose, confirm how each product will deliver findings and response actions to the security tools your team runs. ^{21–24,26–27,60,68–69}

Takedowns

Follow a Takedown from request to outcome.

A demo shows the Takedown case workflow and the Network Enforcement gateways that receive blocks.

Book a demoStart free trial

Managed takedowns and their targets#

Both products offer managed takedowns. Fortra Brand Protection works directly with registrars on the customer's behalf, gathers evidence and submits requests, and a Cybersecurity Insiders review describes a portal where customers can also submit threats. Fortra markets an unlimited takedown model, but contract scope is not public. Fortra states that it can take down spoofed domains and fake websites in under two hours. No public documentation of a median time or contractual service level for that figure was found. Fortra also notes that approval ultimately rests with the registrar. ^{10,12,35–36,39,47,49,62}

Fortra Brand Protection reaches more kinds of target. Named partner categories cover registrars and hosts, social platforms, email providers, URL shorteners, developer platforms and app stores, including Apple App Store, Google Play Store and more than 20 third-party stores. Mitigation also includes automated kill switches, browser blocking, DMCA takedowns and anti-phishing blocklists. Separate Threat Engagement and Disruption seeds phishing sites with canary credentials and engages BEC actors for mule-account intelligence. ^{2,8,34,38–39,67}

Have I Been Squatted runs managed Takedowns for domains. An admin requests one from a lookup result or an alert, or a rule opens the request automatically, and an analyst reviews every request. The team reports the domain to its host and registrar, then escalates to ICANN and regional CSIRTs where necessary. The service stops short of legal action and can introduce legal partners. ^25,35–37

Choose Fortra Brand Protection when a case can move from a domain to a social profile, an app listing or a counterfeit operation. Choose Have I Been Squatted when the case is a malicious domain and you want the Takedown tied to the monitoring and rules that found it. ^{2,15–16,19–20,25,34–39}

Where Fortra Brand Protection is the better choice#

Fortra Brand Protection fits when digital risk spans channels that a domain product does not cover. Social impersonation, fake mobile apps, dark-web collection, credential exposure, counterfeit ads, executive protection and source-code leaks sit in one managed service. Analysts validate detections before escalation, and Fortra runs detection, curation and mitigation for the customer. Emergency support requests receive a stated response within one hour, with client support available around the clock through the web application or API. ^{1–11,13,62–63}

It also suits buyers who want disruption handled for them across registrars, hosts, social platforms and app stores, including marketed unlimited takedowns and adversary engagement through canary credentials. Banks on supported digital banking platforms can use the advertised web beacon, which tracks unauthorized changes to online banking instances. The same vendor sells separate DMARC and cloud email products. PhishLabs was founded in 2008 and has operated under Fortra since 2021. Fortra sells the service through a quote-based contract. ^{2,8,10,13,34,39,42–44,49,55,67,70–71}

Where Have I Been Squatted is the better choice#

Have I Been Squatted fits a team that wants to judge malicious domains and the attacker infrastructure behind them from the evidence itself. Lookalikes of your own domains are one way in, Analyze checks any domain on demand, and Atlas investigations, in early access, pivot to related infrastructure. Results can carry RDAP registration, DNS records, hosting, mail readiness and open ports, with a screenshot when the site serves a page. An analyst can open that page in a live, isolated browser session, then act through maintained library rules or rules your team writes in the Upsilon query language. ^{14–20,25–29,50,53–54,56–59}

Connectors name the products they reach. A rule can send findings to Splunk, Google SecOps, Elastic Security or Microsoft Sentinel, and Network Enforcement blocks flagged domains in Zscaler, Cloudflare Zero Trust, iboss or Microsoft Defender for Endpoint. Rules can also add domains to a hosted domain feed in seven formats, including STIX 2.1 and CSV, with documented MISP setup. When removal is the answer, a rule or an admin requests a managed Takedown, and the team reports the domain to its host and registrar. Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, including sender and URL domains, with the domains you monitor. ^{19–25,31–33,35–37,64–65,72}

You can see the product before you talk to sales. Domain Monitoring watches your domains continuously, and monitoring, hunting tools, rules and alerts are self-serve with public per-domain pricing and a free trial. Takedowns and the email, network, SIEM and canary products are bought through sales. For security review, Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center, and offers Google, Microsoft 365 and SAML single sign-on with audit logging. PDF reports such as the "Domain security overview", and CSV or JSON exports, take findings to stakeholders. End users can add the free Browser Protection extension for Chrome. ^{25–26,28–30,36,53,60–61,73–75}

Have I Been Squatted does not suit a buyer who needs one service to cover domains, social impersonation, fake apps and dark-web exposure. Fortra Brand Protection brings those channels into one managed platform. ^13,40–41

FAQ#