Have I Been Squatted vs Silent Push

• Choose Silent Push when your security team investigates adversary infrastructure beyond your brand and delivers threat intelligence to the tools it already runs. ^1–7
• Choose Have I Been Squatted to detect malicious domains, starting from continuous monitoring of your own, then block them in your gateways and endpoints through rules and hand removal to its own Takedowns team. ^8–17
• Use both when your security team needs broad infrastructure intelligence and your brand team needs a dedicated lookalike monitoring and response workflow. ^{9–11,18–21}

At a glance#

Have I Been Squatted and Silent Push on the decisions a buyer weighs first.

	Have I Been Squatted	Silent Push
What you get
What you get	Detection and response for malicious domains8	Threat-infrastructure intelligence with Indicators of Future Attack1
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context10,22	Domain or asset searches with scheduled new-result alerts23–25
Infrastructure investigation
Infrastructure investigation	Atlas pivots on IPs, nameservers, certificates, favicons, tracking IDs (early access)26–29	Pivots across passive DNS, certificates, WHOIS, favicons, banners30–32
Threat-actor intelligence
Threat-actor intelligence	Managed Threat Intelligence service9,16	IOFA feeds, APT feeds, TLP Amber reports, analyst services2–4
Mail telemetry
Mail telemetry	Microsoft 365 and Google Workspace33–34	Not found5,32,35
Response in your tools
Response in your tools	Rules alert, block, annotate and request Takedowns11,20–21,36–37	IOFA feed export, TAXII and Threat Check lookups2,6,38–39
Managed takedowns
Managed takedowns	Analyst-reviewed domain Takedowns16–17	Not offered (evidence for your takedown provider)40
How you buy
How you buy	Self-serve monitoring subscription9,22	Quote-based, after a demo1,35,41

How each product finds lookalike domains#

Silent Push finds lookalikes through impersonation searches that you save for a target. Domain Impersonation takes a target domain, and Assets Impersonation takes a My Assets folder of owned domains or IPs. Results group candidates into typosquat, homoglyph, combosquat and TLD variants, with overviews of registration date, HTTP response, registrar and ASN. Email Impersonation finds lookalikes that have MX records, while Favicon and HTML Title Impersonation match favicon hashes and page titles. Monitors rerun a saved query every 24 hours and alert you only when something new appears. ^{23–24,31,42–48}

Have I Been Squatted generates and watches lookalikes for each monitored domain, with no keyword or permutation lists to maintain. Discovery combines generated kinds such as homoglyphs, bitsquats and TLD swaps with certificate transparency and newly registered domains. Business context lets agents suggest extra lookalikes, which become results only when they resolve. Each result combines the enrichment available for that domain, such as RDAP registration data, hosting and ASN, DNS records, mail readiness, open ports and a screenshot, with an isolated browser session for a closer look. Typosquat, Analyze and Discovery lookups cover one-off checks outside monitoring. ^{9–10,22,26,29,49–57}

Two further signals show whether a lookalike has reached your people or copied your site. Email Intelligence correlates Microsoft 365 and Google Workspace mail telemetry, such as senders, recipients and URL domains, without MX changes. Site Canaries add a script to your own pages and flag page loads on hostnames you have not recognized. No public documentation of a Silent Push mailbox integration or of beacons that detect copied pages was found. ^{5,32–35,46,48,58–59}

Sending findings to your tools and requesting removal#

Silent Push delivers intelligence through feeds, indicator lookups and connectors to security tools. Curated and customer-built IOFA feeds export as CSV or JSON, and scheduled Feed Search exports add TXT, RPZ, STIX and TAXII formats after the first export runs. Threat Check looks up indicators in bulk against IOFA feeds and Traffic Origin data, through the API or a DNS-based integration. Named connectors reach SIEM, SOAR and threat intelligence platforms, a bidirectional TAXII server shares feeds, and Slack, Teams and custom webhooks carry alerts. ^{2,5–7,35,38–39,60–63}

Have I Been Squatted puts response in rules that run over domain signals. The maintained rules library covers common detections, and your team can write its own rules. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list, annotate the result with a status such as Malicious, or request a Takedown. Network Enforcement sends flagged domains to gateways, endpoints and mail filters, and to a hosted domain feed in seven formats, including STIX 2.1 and CSV, with documented MISP setup. Tools poll the feed, and its STIX output is a static bundle rather than a TAXII server. For a single result, an admin can send one response now, outside any rule, such as a notification, a SIEM finding, a block or a detection. ^{9,11–15,20–21,36–37,49–50,57}

For removal, Silent Push says it does not take down malicious domains. It supplies the evidence for your takedown provider, and impersonation results can be exported as takedown evidence. Have I Been Squatted runs managed Takedowns. An analyst reviews every request, then the team reports the domain to its host and registrar. If a provider does not respond, the team escalates to ICANN and regional CSIRTs where necessary. Takedowns stop short of legal action, and the team can connect you with third-party legal providers. ^{6,9,16–17,32,40,64–65}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

Investigating infrastructure beyond your brand#

Silent Push helps analysts investigate adversary infrastructure beyond a brand's lookalike domains. It builds on first-party data that, Silent Push states, logs changes across the entire IPv4 and IPv6 space. Total View brings a domain's data together, and Silent Push states that it integrates over 100 data points that analysts can pivot on. Passive DNS history shows when records were first and last seen, beside Farsight and Zetalytics third-party passive DNS tabs and a WHOIS Changes chart. ^{18–19,31,35,60,66–70}

Pivots follow shared fingerprints across domains and servers. Context Graph Search runs SPQL, a query language Silent Push lists as alpha, over web, dark web, open-directory, banner and WHOIS scan data. Analysts can match favicon Murmur3 hashes, ssdeep HTML similarity, JARM and server banners, and run sibling, cousin, nameserver and MX hash lookups. Traffic Origin returns the countries where traffic from an IP was detected, and Silent Push markets it as a way to reveal the true country behind a connection. ^{18,30–32,38,46,48,60,68,71–74}

Have I Been Squatted reaches past your own lookalikes with Atlas investigations, in early access. An investigation starts from a hunt you describe and any domains you already suspect, pivots across shared infrastructure in Atlas, its store of domain observations, and keeps watching after the first pass. An admin can add IP addresses, nameservers, favicon hashes or identifiers for it to pivot on. Analysts review results in views such as Tree, Table, Clusters and Flows, and export an investigation as STIX 2.1, CSV or JSON. ^{17,26–29,75–76}

Where RDAP data is available, a lookalike also carries its current registration data, including registration, expiration and last-updated dates, but no record of past owners. Have I Been Squatted records current DNS records but does not collect passive DNS history today, so Silent Push keeps the deeper record of how infrastructure changed. Silent Push suits investigations that start from adversary infrastructure, and Have I Been Squatted suits teams that start with their own domains and need an enriched list of lookalikes to review. ^{9–10,26,29–32,49–51,53–54,67,69–70}

Where Silent Push is the better choice#

Choose Silent Push when infrastructure intelligence is the job and brand lookalikes are one part of it. Its first-party scan data spans six data sources, including banners, open directories and Tor, and its passive DNS and WHOIS history let an investigation reach back in time. IOFA feeds, APT feeds, TLP Amber reports and Intelligence On-Demand analyst services extend that work to threat actors and campaigns. Silent Push states that IOFA often reveal attacks 3 to 6 months in advance. ^{2–4,18–19,31,67,69–70,77}

It also suits a team with a broad security stack. Silent Push names 21 integrations with SIEM, SOAR, threat intelligence and other security platforms, including Microsoft Sentinel, plus a bidirectional TAXII server. A free, account-based version gives researchers full raw passive DNS data with a monthly request quota, for evaluation and research. Its Chrome extension lets an analyst scan a page's domains, IPs and URLs with an API key. ^{1–2,5–7,30,38–39,66–67,78–79}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when your team needs malicious domains detected, blocked and taken down. Lookalikes of your own domains are one way in. Domain Monitoring watches for them continuously, with no keyword or permutation lists to maintain, and Analyze checks any other domain on demand. Rules from the maintained library, or written by your team over a catalog of 173 domain signals, decide whether a finding raises an alert, reaches your SIEM or gets blocked. A rule can also request a managed Takedown, and an analyst reviews every request before the team reports the domain to its host and registrar. ^{8–11,16–17,20–22,49–50,55–57,65,80–81}

Blocking happens in the tools you already run. Network Enforcement pushes rule-flagged domains to Zscaler, Microsoft Defender for Endpoint, Cloudflare Zero Trust and iboss, and to Microsoft 365 Quarantine and Cloudflare Email Security for mail. Network Intelligence reads Microsoft Defender every 15 seconds and Cloudflare Gateway every minute, showing which domains devices on your network reached. End users can add the free Browser Protection extension for Chrome, which warns on dangerous or suspicious sites. ^{9,12–15,21,82–83}

Monitoring, hunting tools, rules and alerts are a public self-serve subscription with a free trial. Takedowns and the email, network, SIEM and canary products are added through sales. For a security review, Have I Been Squatted has a SOC 2 Type II report, available through its Trust Center. No public documentation of a SOC 2 or ISO 27001 report was found for Silent Push. ^{9,22,55–57,78,82,84–85}

A buyer who wants one platform for adversary infrastructure hunting, threat-actor feeds and proxy-origin data is better served by Silent Push. Have I Been Squatted does not scan the dark web, and it has no equivalent to Traffic Origin. ^{2–4,74,86–87}

FAQ#