Have I Been Squatted vs openSquat

• Choose openSquat for a GPL-3.0 CLI you can inspect and script against your own domain list, or for low-cost hosted keyword alerts. openSquat's free Community plan includes one daily email alert, paid plans start at USD 29 a month, and Slack and Microsoft Teams alerts start at USD 49 a month. The free daily feed and the Community and Starter plans are for non-commercial use only. ^1–16
• Choose Have I Been Squatted for continuous detection of malicious domains, starting from lookalikes it generates, with registration, hosting and mail evidence where available, and rules that alert, block or request a Takedown. ^17–27
• Use both if you already match keywords with openSquat and want Have I Been Squatted to generate lookalikes of your own domains, enrich each hit and drive the response. ^{3–9,18–22,25–27}

At a glance#

Have I Been Squatted and openSquat on the decisions a buyer weighs first.

	Have I Been Squatted	openSquat
What you get
What you get	Detection and response for malicious domains17	Open-source CLI with local keyword matching3
Hosted service
Hosted service	Monitoring, enrichment, rules and Takedown requests25–27	Free and paid plans with keyword alerts and an MCP server10,12–13
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context19–20	Keyword match by edit distance and substring against candidate domains3–9
Newly registered domains
Newly registered domains	Vendor states gTLD zone files, past 30 days20	Free daily feed of about 100,000; larger paid feed3,10–11,28–29
Schedule
Schedule	Vendor states at least once every 24 hours20	CLI runs from cron; hosted alerts run daily3,10–11,13
Alerts and case status
Alerts and case status	Alert statuses and digests on monitored results19,30	Hosted daily keyword alerts; no alert status found4,10,13–14
Alert channels
Alert channels	Email digests, Slack, webhooks and SIEMs25–27,31–32	Email; Slack and Microsoft Teams from Professional12–14,33
Enrichment on results
Enrichment on results	Registration, DNS, ports, page semantics, HAR21–22	Optional Quad9, VirusTotal, phishing list, ports 80/4433,34–37
Response workflow
Response workflow	Alerts, SIEM delivery, blocking, annotation, Takedown requests25–27,31–32	CLI files; CSV attached to hosted alerts3,12–13,38–39
Price
Price	Pro: USD 199.99 per domain a year18,20	Free CLI and Community plan; paid plans from USD 29 a month10

A local CLI, hosted plans and a hosted platform#

openSquat comes in two parts. openSquat Core is a command-line tool you install and run yourself, and hosted plans, from a free Community plan to paid tiers, run on openSquat's own servers. Have I Been Squatted runs only as a hosted service. ^{2–3,10–13,18–19}

openSquat Core is GPL-3.0 code that you can inspect and change, and its default mode matches keywords in a local process, so brand keywords stay on your machine. That mode downloads a free daily feed with no account and uses a checksum file to skip unchanged downloads. The free feed is for personal and research use only, and a company can point openSquat at its own domain file or URL instead. ^{1–9,11,14,28}

The hosted plans run keyword searches on openSquat's servers through an API, which the CLI can also call with an API key. Results come back with per-domain IDN and Unicode fields, and optionally a similarity rating, a risk level, a threat score and threat tags. The free Community plan allows five queries a day with one day of history and 10 results per query. Starter, Professional and Business cost USD 29, 49 and 199 a month, or USD 290, 490 and 1,990 a year. They raise the monthly quota to 300, 1,000 and 10,000 queries, the history window to as much as 30 days and the results to as many as 500 per query. Community and Starter are for non-commercial use, and Professional and Business include a commercial license. ^{2–4,8,10–13,15–16,29,35,40}

Every openSquat hosted plan can schedule daily keyword alerts by email, from one alert on Community to 10 on Business, and Professional and Business also post alerts to Slack and Microsoft Teams. An MCP server on any plan lets an AI assistant run the same searches against the plan's quota. openSquat's home page also advertises a dashboard search with one-click CSV export. A larger newly registered domain feed, NRD Lite, is a separate subscription at USD 39 a month or USD 390 a year. The CLI can download a paid feed with an API key and match it locally. ^{3–4,10,12–14,16,28–29,33,41–42}

Have I Been Squatted is a hosted product, and you do not run a scanner yourself. The twistrs library its permutations are built on is open source under the MIT license, while monitoring, enrichment and response run in the hosted service. Ad-hoc Typosquat and Analyze lookups are free, Domain Monitoring and rules sit on a public self-serve subscription, and a 14-day free trial is available. Takedowns and the email, network, SIEM and canary products are bought through sales. Analysts can also work from AI agents through the MCP server or the Slack app. Organization writes need an admin and the right scopes, MCP marks write tools so the client asks for confirmation, and Slack writes wait for Approve or Deny. ^{18–21,43–50}

How each tool finds lookalike domains#

Both parts of openSquat match keywords you supply against a list of candidate domains, and Have I Been Squatted generates and gathers the candidates itself. By default the openSquat CLI downloads the free feed of about 100,000 newly registered domains per day and runs local Levenshtein distance and substring matching against it. The distance threshold is a confidence level from 0 to 4, and a match also fires when the keyword appears inside the full domain name. Homograph handling transliterates non-Latin characters to Latin before the distance check, so a Cyrillic lookalike can still match. ^{3–11,19–20,28–29,51}

This run checks one keyword, haveibeensquatted, against one daily feed and writes a results file. ^{3,12–13,38–39}

$ opensquat -k keywords.txt --dns -o results.txt -t txt
[*] keywords total: 1
[*] Total domains: 100,000
[*] Threshold: high confidence
+---------- Summary Squatting ----------+
[*] Domains flagged: 0
[*] Domains result: results.txt
[*] Running time: 2.44 seconds

The run covers one day's feed of 100,000 domains, so a lookalike registered on another day is outside it. Running openSquat daily from cron covers each new feed as it arrives. The larger paid feed, your own domain file and the hosted API's history window of up to 30 days each widen the candidate set. openSquat states that its service processes more than 300,000 newly registered domains a day from zone files for over 1,000 TLDs, against about 100,000 in the free feed. The hosted API can also return a risk level, a threat score from 0 to 100, and tags for phishing keywords, homographs, high-abuse TLDs and domains under three days old. openSquat also states that the hosted service scores each domain with Levenshtein distance, homoglyph analysis, IDN decoding and phishing keyword patterns. ^{3–13,15,28–29,35,40}

Have I Been Squatted discovers lookalikes without a keyword or permutation list to maintain. Domain Monitoring combines generated permutations, including homoglyphs, bitsquats and TLD swaps, with certificate transparency and newly registered domains. Have I Been Squatted states that newly registered matches come from gTLD zone files covering the past 30 days, and that lookups run at least once every 24 hours after you add a domain. ^19–20,22

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

What happens after a match#

The openSquat CLI hands you a results file, its hosted plans send a daily alert per keyword, and Have I Been Squatted keeps each result in a hosted queue with alert statuses and responses. The CLI writes its matches to a TXT, JSON or CSV file. Optional flags add a Quad9 DNS check, VirusTotal votes, a phishing-domain list, a port check on 80 and 443, and a crt.sh lookup in doppelganger mode. No notification, webhook or email code was found in the CLI. ^{3–4,10,12–14,34–39}

openSquat's hosted alerts send a daily email per keyword that lists up to 25 matches and attaches a CSV of every match. On Professional and Business, openSquat also posts the same alerts to Slack and Microsoft Teams through incoming webhooks. Each alert keeps a run history with the full match list in the dashboard. No allowlist, alert status field, or named SIEM, SOAR or ticketing connector was found in the CLI code or the hosted pages reviewed. ^{3–4,10,12–14,33,38–39}

Picture a one-person security team that protects three brand names. With the CLI, they keep a keyword file, run openSquat from cron after each daily feed update, and feed the JSON or CSV output into their own pipeline. On a Professional plan, they can instead set up to five daily keyword alerts that arrive by email, Slack or Teams. Either way, reporting a lookalike to its host or registrar is a separate job for the team. ^{3–4,10–16,33,38–39}

Have I Been Squatted keeps state between lookups. Each result can carry RDAP registration data, hosting details, DNS records, mail readiness, open ports and a capture of the website, and an analyst can open the page in an isolated browser. Rules turn those observations into alerts with statuses and digests. A rule can raise an alert, notify Slack, send a finding to a SIEM, push the domain to a block list, mark the matched result Malicious with a note, or request a Takedown. Network Enforcement sends flagged domains to gateways, endpoints, mail filters and a hosted domain feed. ^{18–27,30–32,45,52–60}

For the same three-brand team, the difference shows up on the second day a lookalike resolves. In Have I Been Squatted the match is already enriched and its alert status is tracked, so an admin can request a Takedown from the alert. An analyst reviews every request, and Have I Been Squatted reports the domain to its host and registrar. ^{18–19,30,61–63}

Where openSquat is the better choice#

openSquat fits when you want to own a scriptable keyword check end to end. The code is free under GPL-3.0, anyone can read and change it, and default matching keeps brand keywords on the machine that runs the scan. Homograph transliteration, optional enrichment flags, and TXT, JSON or CSV output drop into an existing cron pipeline. The project is actively maintained, and recent releases treat downloaded phishing lists as untrusted input and stop API keys leaking on redirects. This suits an engineer who wants to inspect or change the matching code and already has a workflow for scheduling, triage and response. ^{1–4,14,34–37,51,64–65}

openSquat's hosted plans fit a team that wants daily keyword alerts without running code. Prices are public and self-serve, from a free Community plan to USD 199 a month for Business, and the MCP server works on every plan. openSquat's Slack and Microsoft Teams alerts start on the USD 49 a month Professional plan, which also includes a commercial license. In Have I Been Squatted, Slack and webhook connectors come with the Business plan at USD 799.99 per domain a year, and Microsoft Teams is listed as coming soon. If keyword alerts in Slack or Teams are all you need, openSquat costs less today. ^{3–4,10,12–16,18,25,33}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when you want malicious domains found and handled without maintaining a keyword list. Lookalikes of your own domains are the way in. Domain Monitoring watches continuously, generates permutations such as homoglyphs, bitsquats and TLD swaps, and adds certificate transparency and newly registered domains. Discover lists unregistered permutations that could later be used for phishing or impersonation, and Analyze checks any other suspicious domain on demand. ^{17–22,44–46,66–67}

Each hit comes with the evidence to triage it. Results can carry RDAP registration data, hosting and ASN, DNS records, mail readiness and open ports, and an analyst can inspect a served page in a live, isolated browser session. Rules from the maintained library, or your own in the Upsilon query language, can raise an alert, send the finding to a SIEM, block the domain or request a Takedown that an analyst reviews. No screenshot capture or takedown workflow was found in the openSquat CLI or on its hosted plan pages. ^{3–4,10,12–14,18–27,33,45,52–55,62}

Scripting stays available. The Public API streams lookup, analyze and certificate transparency search results as NDJSON, with scoped API keys and a Python SDK. A scheduled job or pipeline can call Have I Been Squatted directly. A company can start monitoring, hunting tools, rules and alerts self-serve with a free trial. Takedowns and the network, email and SIEM products are added through sales. ^{18,20–21,44–47,66,68}

Have I Been Squatted does not suit teams that require self-hosted scanning, or that only need a free local pass over one day's newly registered domains. openSquat matches keywords locally against a supplied domain file, although its feed downloads and optional lookups need network access. Have I Been Squatted also does not monitor social media, app stores, the dark web, ads or leaked credentials. ^{3–9,14,34–37,43,69–70}

FAQ#