Have I Been Squatted vs Red Points

• Choose Red Points when abuse spans domains, marketplaces, social media, ads and apps, and you want specialists to manage detection and enforcement. ^1–7
• Choose Have I Been Squatted when your security team treats malicious domains and their infrastructure as incidents, with mail, port and live-page evidence, and wants response in its SIEM, gateways and endpoints. ^8–21
• Use both when Red Points manages your wider brand program and your security team needs domain response in its own tools. ^{1–6,9,11,15–16,18–21}

At a glance#

Have I Been Squatted and Red Points on the decisions a buyer weighs first.

	Have I Been Squatted	Red Points
What you get
What you get	Detection and response for malicious domains8	Fully managed brand protection, including domains7
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context10,22	Brand audit and monitoring across domains, pages and brand assets23–25
Who runs enforcement
Who runs enforcement	Analyst-reviewed Takedowns; rules can open requests26–27	IP-Ops runs detection through enforcement24,28
SIEM and webhook delivery
SIEM and webhook delivery	Splunk, Sentinel, Google SecOps, Elastic, Slack and webhooks14,17	Not found: Not found24,29
Managed takedowns
Managed takedowns	Domains, to host and registrar, with escalation26–27,30–31	Hosts, registrars, CDNs, social, ads, apps7,24,32–34
Recover a disputed domain
Recover a disputed domain	Legal partner introductions31	UDRP, URS and national disputes, with transfer and recovery1,33–34
Beyond domains
Beyond domains	Not covered: social, apps, dark web, ads35–36	Social, ads, apps, marketplaces, search, executives1–3,37–38
How you buy
How you buy	Self-serve monitoring subscription10,31	Quote-based flat fee for managed programs1

Who runs the queue after a finding#

Red Points operates the program for you, while Have I Been Squatted lets your security team set the response and has its own analysts handle Takedowns. At Red Points, IP-Ops specialists handle detection, validation, enforcement and continuous optimization, and every program includes a dedicated Customer Success Manager. Your team reviews incidents. After activation, you choose in the Portal whether each finding is enforced or discarded. Red Points says that decision can also be automated, and brands can set up rules that automate the enforcement process. ^{1–2,7,24,26–29,33,37,39–40}

With Have I Been Squatted, your team configures the response. A maintained rules library covers common detections, and you can add your own rules over domain signals. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list or request a Takedown. It can also mark each matched result with a status such as Malicious and a note. Network Enforcement sends flagged domains to gateways, endpoints, mail filters and a hosted domain feed. ^{9,11,14–16,18–21,31,41–42}

Have I Been Squatted analysts review every Takedown request, and Managed Threat Intelligence is also available as a managed service. An MCP server lets agents work the same alerts and Takedowns, and every write needs an admin. If you run both products, agree which one owns domain triage and takedown requests. ^{26–27,31,43–47}

Managed takedowns and domain recovery#

Both products run managed takedowns, and Red Points reaches more intermediaries and adds legal recovery of domains. Red Points sends notices to hosts and registrants, then escalates to CMS platforms, hosts, registrars, CDNs and other intermediaries. Its programs carry a flat fee with unlimited takedowns within an agreed scope, and its impersonation plans include pushbacks and counter-notices. Red Points states an average domain takedown time of one to seven days, and claims it can help suspend fraudulent domains before any content is published through registrar and host partnerships. ^{1,7,24,26–27,32–34,48}

Red Points also recovers domains through legal dispute processes. Domain Dispute Resolution files and manages UDRP, URS and national dispute resolution proceedings, with domain transfer and recovery. Red Points is not a law firm. Have I Been Squatted does not take legal action and can introduce legal partners. ^{1,31,33–34,49}

Have I Been Squatted runs managed Takedowns for domains. An analyst reviews every request, and a rule can open a request automatically, so the Takedown starts from the same monitoring that found the domain. The team reports the domain to its host and registrar, then escalates to ICANN and regional CSIRTs where necessary. ^{22,26–27,30–31}

Coverage beyond lookalike domains#

Red Points covers channels that Have I Been Squatted does not. It manages brand abuse across domains, marketplaces, social media, ads and apps, and a brand or legal team can use the same service to validate counterfeit listings, fake profiles and fraudulent shops, then pursue enforcement. Domain Management detects, monitors and reclaims domains that misuse the brand. Red Points states that marketplace coverage spans 5,000 or more marketplaces, and it also covers domestic platforms in Mainland China and brand and executive impersonation. ^{1–3,7,23,37–38,50}

Have I Been Squatted concentrates on domains and the threats built on them. Domain Monitoring generates lookalikes and watches certificate transparency and newly registered domains. Email Intelligence adds mail telemetry from Microsoft 365 and Google Workspace, and Site Canaries flag copies of your own pages. Have I Been Squatted does not monitor social media, app stores, the dark web or ads. ^{10,22,31,35–36,51–53}

Takedowns

Follow a Takedown from request to outcome.

A demo shows the Takedown case workflow and the Network Enforcement gateways that receive blocks.

Book a demoStart free trial

Finding and investigating lookalike domains#

Red Points matches sites against your brand assets, while Have I Been Squatted gives your analysts domain evidence and pivots to inspect. Red Points compares logos, page images, objects and extracted text with approved brand assets, including domains that do not contain the brand name. Brand audit returns a historical list of infringing domains, and brand monitoring finds newly registered ones from domain databases, search-engine crawling and machine learning on the brand's enforcement history. In its Cotopaxi case study, Red Points reports that it grouped related scam domains by shared hosting, repeated storefront templates, product images and naming patterns. ^{23–25,33,40,54–55}

Have I Been Squatted combines generated lookalikes, such as homoglyphs, bitsquats and TLD swaps, with certificate transparency and newly registered domains. Results can include RDAP registration data, hosting details, DNS records, mail readiness, open ports and a capture of the website. An analyst can check whether a lookalike resolves, is set up for email or serves a copied page, then open it in an isolated browser. ^{9–13,22,31,56–60}

For campaign work, Have I Been Squatted runs Atlas investigations, in early access. One starts from a plain-language hunt, optionally seeded with domains you already suspect, and pivots across shared infrastructure in Atlas, the store of domain observations. An admin can add indicators such as IP addresses or nameservers as it runs. It keeps watching after the first pass, rerunning its searches on a schedule, and shows results in views such as Tree, Table, Clusters and Flows. Findings export as STIX 2.1, CSV or JSON for other tools. ^{27,46,59–63}

Where Red Points is the better choice#

Red Points fits when brand protection is a multi-channel program. Marketplaces, social media, ads, app stores, search deindexing and executive impersonation sit beside domain work under one managed service. IP-Ops specialists run the queue, and the pricing model is a quote-based flat fee for unlimited detections and takedowns within scope. Red Points reports 300 or more employees and 1,300 or more brands, with offices in the United States, Spain and China. ^{1–7,29,37–38,64–65}

It also suits buyers who need domain recovery through UDRP, URS or national proceedings, or asset-based visual detection across logos, page images and product photos. Customer stories such as KEEN and Cotopaxi describe fake shops and spoofing scams that spilled into customer complaints and fraudulent orders. Red Points works with mid-market and enterprise companies where brand protection is a strategic priority, including legal, cybersecurity and e-commerce teams. ^{1,7,24,29,33–34,40,66}

GoDaddy customers have a separate entry route. Red Points offers them fake-website protection as a one-time audit, monthly detection for one brand, or detection with a set number of confirmed takedowns a year. ⁴⁸

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when malicious domains and the infrastructure behind them are a security incident for your team as well as a brand problem. Each result can show whether the domain is set up for email, which ports are open, and its RDAP registration and hosting. Lookalikes of your own domains are one way in, with certificate transparency and newly registered domains added to generated lookalikes, and Analyze checks any other domain on demand. An analyst can open a live page in an isolated browser session. ^{8–13,22,31,43–44,56,67–68}

Response runs in your security stack. Rules come from the maintained library or are written by your team in the Upsilon query language. A match can send the finding to Splunk, Google SecOps, Elastic Security or Microsoft Sentinel, or block the domain in Zscaler, Cloudflare Zero Trust or Microsoft Defender for Endpoint. It can also request a managed Takedown, which the team reports to the host and registrar. Network Intelligence shows which flagged domains devices on your network reached. Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, including sender and URL domains, with the domains you monitor, and Site Canaries flag cloned copies of your own pages. ^{9,11,14–21,26–27,30–31,41–42,51–53,69–70}

You can sign up and start a free trial without a sales call. Domain Monitoring then watches your domains continuously, and the hunting tools, rules and alerts are self-serve too. Takedowns and the email, network, SIEM and canary products are bought through sales. For security review, Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center, with Google, Microsoft 365 and SAML single sign-on and audit logging. PDF reports and CSV or JSON exports take findings to stakeholders outside the security team, and end users can add the free Browser Protection extension for Chrome. ^{10,22,27,31,43,46,59,63,69,71–73}

Have I Been Squatted does not suit a buyer who wants one vendor to cover social media, ads and apps as well as domains. Red Points covers those channels, and marketplaces, in one managed program. ^{1–6,35–36}

FAQ#