Have I Been Squatted vs Netcraft

• Choose Netcraft for phishing and brand abuse across websites, social media, app stores, ads, phone numbers and the dark web, with managed takedowns and partner-feed blocking while a case runs. ^1–9
• Choose Have I Been Squatted for detection and response on malicious domains, with rules you write, a self-serve start, and blocking in Zscaler, Microsoft Defender for Endpoint or Cloudflare Zero Trust added through sales. ^10–21
• Use both if Netcraft runs your wider brand and phishing program and your security team wants domain rules and response in its own stack, with one product named as the owner of domain takedown requests. ^{1–5,11–14,17–20}

At a glance#

Have I Been Squatted and Netcraft on the decisions a buyer weighs first.

	Have I Been Squatted	Netcraft
What you get
What you get	Detection and response for malicious domains10	Phishing detection and takedown8,22
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context16,23	Lookalikes and hostnames from CT logs, zone files and other feeds24
Who writes the rules
Who writes the rules	Maintained library and customer-authored rules11–14	Netcraft-authored rules; customers view patterns3,24–25
Response in your tools
Response in your tools	Rule alerts, SIEM events, blocks, Takedown requests11,14,26–28	Splunk, Sentinel, XSOAR, ThreatConnect and Slack; takedowns from Splunk and XSOAR6,29–30
Blocking while a case runs
Blocking while a case runs	Blocks in the customer's gateways and endpoints17–20	Partner feeds to browsers and vendors, plus in-browser blocking8–9,31
Managed takedowns
Managed takedowns	Domains, to host and registrar, with escalation15,32–34	Hosts, registrars, social, apps, email and telephone2,4,7
Beyond domains
Beyond domains	Not covered: social, apps, ads, dark web35–36	Social, ads, apps, dark web, phone, scam chats1–5
How you buy
How you buy	Self-serve monitoring subscription15–16	Quote-based contract37

Coverage beyond lookalike domains#

Netcraft detects and takes down phishing and brand abuse well past domains. Domain Monitoring and Domain Protection find lookalike domains and hostnames, including names that are not yet hosting infringing content, and Netcraft states that it checks monitored domains every day. That work sits beside phishing protection, Preemptive Domain Disruption, social media and executive impersonation coverage, malicious ads, mobile app searches, deep and dark web monitoring, phone scam disruption and generative-AI scam engagement. ^{1–5,8,22,24,38–39}

A brand or fraud team can hand Netcraft its phishing sites, fake profiles, rogue apps, leaked credentials and scam phone numbers, and route the findings that have grounds for removal through one takedown workflow. Customer APIs cover takedowns, classification and screenshots for teams that automate the hand-off. ^1–7,29

Have I Been Squatted concentrates on domains and the threats built on them. Domain Monitoring generates lookalikes and watches certificate transparency and newly registered domains. Email Intelligence adds mail telemetry from Microsoft 365 and Google Workspace, and Site Canaries flag copies of your own pages. Have I Been Squatted does not monitor social media, app stores, the dark web, ads or leaked credentials. ^{15–16,23,35–36,40–42}

How each product investigates a lookalike domain#

Netcraft analyzes suspicious sites across devices and countries and follows multi-stage attacks, while Have I Been Squatted brings domain, mail and hosting evidence to an analyst. Netcraft's lookalike discovery draws on certificate transparency logs, zone files, DNS registrations, referrer logs, malicious ad monitoring and related feeds. Customers can view the patterns, probe strings and certificate patterns used to find URLs. Website analysis uses a proxy network for screenshots across devices and countries, plus a headless browser that fills forms across multi-stage attacks. Netcraft names visual similarity, OCR and fuzzy matching as analysis signals, and its classification API returns a risk score from 0 to 10 with a deceptive domain score. ^{6–7,12–13,24–25,29,31,43}

On the Have I Been Squatted side, discovery combines generated lookalikes, such as homoglyphs, bitsquats and TLD swaps, with certificate transparency and newly registered domains. Results can include RDAP registration data, hosting details, DNS records, mail readiness and open ports, plus a screenshot when the site serves a page. An analyst can check whether a lookalike resolves, is set up for email or serves a copied page. A phishing page can sit on a path or load only with a token in its query. A signed-in analyst can have Analyze open that exact URL in the dashboard, through the API or through the MCP server. ^{12–13,15–16,23,44–53}

Netcraft's proxy network and form-filling browser matter when a suspicious site changes what it shows by device, country or interaction. Have I Been Squatted brings registration, hosting, DNS records and mail readiness together, so an analyst can inspect a lookalike and, when it serves a site, open it in an isolated browser. ^{7,12–13,16,31,48,53}

Acting on a finding in your own tools#

Netcraft connects takedown work into the SOC. Named integrations include Splunk with a bi-directional app, Microsoft Sentinel, Cortex XSOAR and XSIAM, ThreatConnect and Slack. Analysts can report and authorize takedowns from Splunk, and documented XSOAR commands report, authorize, escalate and track them. Netcraft's Microsoft Sentinel solution brings takedown, domain detection, social, app, ad and dark web results into Sentinel, where pre-built analytics rules raise incidents. Netcraft authors the detection rules. ^{3,6,24–25,29–30}

Have I Been Squatted puts response in rules that run over domain signals. A maintained rules library covers common detections, and your team can add its own rules. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list, mark the result Malicious with a note or request a Takedown. Network Enforcement sends flagged domains to gateways, endpoints, mail filters and a hosted domain feed. Network Intelligence reads traffic counts from Microsoft Defender and Cloudflare Gateway, so you can see whether devices on your network connected to a flagged domain. An MCP server lets agents work the same alerts and Takedowns, and every write needs an admin. ^{11–15,17–21,26–28,45,54–57}

No public documentation of named delivery into a customer's Cloudflare Gateway, Zscaler or Defender tenant, or of a customer-facing MCP server, was found for Netcraft. ^5,8–9,31

Takedowns

Follow a Takedown from request to outcome.

A demo shows the Takedown case workflow and the Network Enforcement gateways that receive blocks.

Book a demoStart free trial

Managed takedowns and blocking while they run#

Both products run managed takedowns, and Netcraft reaches more parties and adds blocking through its partners. On Netcraft, a customer reports or authorizes a takedown, with configurable auto-authorization per attack type, and an automated takedown can escalate to a managed takedown. Status steps include Contacted Hosting, Contacted Police and Contacted Upstream. Netcraft contacts webmasters, registrars and registries, hosts, social platforms, email providers, upstream ISPs, app stores and telephone providers. ^{2,4,6–9,32–33}

While a takedown runs, Fraudcast sends confirmed threats to major browsers and security vendors. Netcraft states that the feeds publish a delta every five minutes with a 0.02% false-positive rate, and that a second person verifies before blocking where there is reason to be cautious. Downstream blocking remains at each partner's discretion. Customers can also block access within browsers through Netcraft's own apps and its free extension for Chrome, Firefox and Edge. Netcraft states that Preemptive Domain Disruption removes domains before malicious content goes live, using evidence criteria refined with infrastructure providers, who retain discretion to validate risk. ^{6–9,31,38–39,43,58}

Have I Been Squatted runs managed Takedowns for domains. An admin requests one from a Lookup result or an alert, or a rule opens the request automatically, and an analyst reviews every request. The team reports the domain to its host and registrar and escalates to ICANN and regional CSIRTs where necessary, stopping short of legal action, though it can introduce legal partners. The case record shows status through review, evidence gathering and provider notification, with analyst notes, and progress updates go by email. Network Enforcement pushes flagged domains into the customer's own gateways and endpoints rather than into partner browser feeds. ^{15,17–20,32–34}

Choose Netcraft when a case can move from a domain to a social profile, an app listing or a phone number, or when you want partner-feed blocking while it runs. Choose Have I Been Squatted when the case is a malicious domain and you want the Takedown and the blocking in your own tools tied to the rules that found it. ^{2,4,7–9,11–15,17–20,32–34}

Where Netcraft is the better choice#

Choose Netcraft when your team needs one provider to detect and remove abuse across websites, social profiles, ads, apps and phone numbers. Netcraft monitors the dark web too, and states that it removes stolen credentials and data there when possible. Its provider relationships matter when removal is the core of the service. Netcraft states that most removals go through direct API or provider contacts, and that it takes down about one-third of global phishing attacks. Netcraft also states 24x7 operations for phone-number work. It suits buyers who want Preemptive Domain Disruption before content goes live, and partner blocking while a takedown runs. ^{1–5,7–9,38–39,59–60}

For buyers who assess supplier assurance, Netcraft states that its first SOC 2 Type 2 report noted no exceptions, and Forrester evaluated it in the Forrester Wave for External Threat Intelligence Service Providers, Q3 2026. Help Net Security describes the service as a subscription for financial institutions, governments and corporations, and Netcraft states that seven of the 12 top US financial institutions are customers. Purchases use a quote-based contract. ^{37,59,61–63}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when your security team wants to detect malicious domains and decide itself what happens to them. Lookalikes of your own domains are the starting point, the Analyzer checks any other domain on demand, and Atlas investigations, in early access, pivot across shared infrastructure from a hunt you describe and the domains or indicators you give them. Your team takes rules from a maintained library or writes its own in the Upsilon query language. Rules read a catalog of 173 domain signals, from registration and DNS to page semantics and favicon hashes. One rule can raise an alert, send the finding to a SIEM such as Splunk or Microsoft Sentinel, block the domain or request a Takedown. When a lookalike serves a page, an analyst can open it in an isolated browser session and interact with the live site. ^{10–16,23,26–28,44–46,48,51–53,64–65}

Blocking and network visibility land in the tools you already run. Network Enforcement pushes rule-flagged domains to Zscaler, Microsoft Defender for Endpoint, Cloudflare Zero Trust, iboss and mail filters. It can also publish them in a hosted domain feed with seven formats, including STIX 2.1 and CSV. Network Intelligence reads Microsoft Defender every 15 seconds and Cloudflare Gateway every minute, so you can see which domains devices on your network reached. Email Intelligence matches lookalike sender domains in Microsoft 365 and Google Workspace mail to the domains you monitor. ^{14,17–21,40–41}

You can start without a sales call. Domain Monitoring watches your domains continuously, and monitoring, hunting tools, rules and alerts are self-serve with public per-domain pricing and a free trial. Takedowns and the network, email and SIEM products are added through sales. Findings leave the platform as PDF reports, such as the "Domain security overview" and "Compliance readout", or as CSV and JSON exports. For supplier review, Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center, and stores and processes data in the United States. Members sign in through Google, Microsoft 365 or SAML single sign-on, and audit logging is built in. ^{15–16,21,23,33,45,51,53–54,56,66–68}

Have I Been Squatted does not suit teams that want social media, app-store, ad and dark-web coverage from the same vendor. Netcraft covers those channels, and phone scams, alongside domains. ^{1–5,35–36}

FAQ#