Have I Been Squatted vs URLCrazy

• Choose URLCrazy for a free local typo generator with editable word lists and CSV or JSON output for one domain at a time. ^1–10
• Choose Have I Been Squatted to detect malicious domains and the infrastructure behind them, with RDAP registration data and a screenshot on registered lookalikes where available, and rules that alert or request a Takedown. ^11–25
• Use both when URLCrazy produces one-off typo lists, with or without DNS checks, and Have I Been Squatted watches your domains on a schedule. ^{1–2,12–13,26}

At a glance#

Have I Been Squatted and URLCrazy on the decisions a buyer weighs first.

	Have I Been Squatted	URLCrazy
What you get
What you get	Hosted detection and response for malicious domains11	Local Ruby CLI for typo generation and DNS checks2,5
How you run it
How you run it	Scheduled hosted lookups26	One domain per CLI run2,7,27–28
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context13,26	Generated variants of one domain, then resolved1–2,7
Registration data
Registration data	RDAP registration data13–16	Does not check registration1–2,29
Results you work with
Results you work with	Alerts, SIEM delivery, blocking, annotation, Takedown requests19–23	Human, CSV or JSON output to a file2,10
Managed takedowns
Managed takedowns	Analyst reviews every request24–25	Not found1–2,30
How you get it
How you get it	Self-serve monitoring subscription12,26	Custom license; use and distribution allowed1–2,4–6

One-off CLI runs versus scheduled monitoring#

URLCrazy runs once per command against one domain, while Have I Been Squatted runs scheduled lookups for every domain you add. URLCrazy is a Ruby command-line tool. It generates typo and variant domains for its one input, drops names that fail its offline TLD and SLD validity table unless you pass -i, then resolves A, MX and NS records for the rest. The README states that with default options it checks over 2,000 typo variants for google.com. ^{1–2,5,7,29–30}

Have I Been Squatted is a hosted Domain Monitoring product. It combines generated lookalikes with certificate transparency and newly registered domains, and states that lookups run at least once every 24 hours after you add a domain. Ad-hoc Typosquat, Analyze and Discovery lookups cover one-off hunts without waiting for the next scheduled pass. ^{12–13,18,26,31–32}

Picture a security team that owns three brand domains. A URLCrazy workflow runs the CLI for each domain and saves CSV or JSON output, and the team supplies the schedule and the comparison between runs, by script or with a wrapper. A third-party wrapper, CrazyParser, ran URLCrazy over a list of domains and emailed new results. With Have I Been Squatted, the team adds the domains once and reviews findings from the scheduled lookups. ^{2,7,10,12–13,26–28}

DNS answers and investigation evidence#

URLCrazy reports what DNS returns for each variant, and Have I Been Squatted adds registration, hosting and website evidence. For each variant, the default URLCrazy report shows the typo type, the first A record, a country from the bundled IP table, the first NS and the first MX. Optional -p asks a search engine for a result count, which the project describes as a popularity estimate. No public documentation of screenshots, page crawls, phishing scores or risk verdicts was found. ^{1–2,10,29–30,33–34}

A run of URLCrazy 0.8.2 against haveibeensquatted.com generated 2,229 hostnames, among them typo, keyboard and TLD-swap permutations, then looked each one up in DNS. The excerpt keeps the original domain and four candidates that had a DNS answer. The second view repeats the same rows with the name server and mail server columns, so each line fits the page. ^{1–2,7,10,27,29–30,35–36}

$ urlcrazy -n haveibeensquatted.com
URLCrazy Domain Report
Domain    : haveibeensquatted.com
Keyboard  : qwerty
At        : 2026-11-04 23:58:00 +0100
# Please wait. 2229 hostnames to process

Typo Type           Typo Domain             IP                    Country
Original            haveibeensquatted.com   2606:4700::6812:13f5
Character Omission  haveibeensquated.com
Character Repeat    haveibeeensquatted.com
Wrong TLD           haveibeensquatted.dev   76.76.21.21           UNITED STATES (US)
Wrong TLD           haveibeensquatted.ws    64.70.19.203          UNITED STATES (US)

Typo Domain             NameServer                 MailServer
haveibeensquatted.com   nile.ns.cloudflare.com     alt2.aspmx.l.google.com
haveibeensquated.com    carlane.ns.cloudflare.com
haveibeeensquatted.com  may.ns.cloudflare.com      route3.mx.cloudflare.net
haveibeensquatted.dev   kellen.ns.cloudflare.com
haveibeensquatted.ws                               mail.hope-mail.com

Two of these candidates are typos of the brand name. haveibeensquated.com returns a name server, and haveibeeensquatted.com returns a name server and a mail server. Neither returns an A record. URLCrazy does not check whether a domain has been registered, so the report alone does not show who holds a name or whether it is abusive. Registration and website evidence is the next step. ^1–2,29

Have I Been Squatted collects that evidence after discovery. Beyond MX records, which URLCrazy also reports, results can carry RDAP registration data, ASN and hosting, DNS records, the SMTP banner, open ports and a capture of the website. An analyst can open a lookalike in an isolated browser, then apply classification scores and custom rules over those signals. ^{10,12–18,20,23,26,29,37–41}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

After the scan, scripts versus rules and response#

URLCrazy hands its results to your scripts, while Have I Been Squatted turns them into alerts and response actions. URLCrazy writes human, CSV or JSON output to the terminal or a file. No public documentation of alert delivery, a suppression list, case state, webhooks or a SIEM connector was found in the project. ^1–2,10,28

In Have I Been Squatted, alert statuses cover Active, Resolved, Ignored and False Positive, with optional digests. A maintained rules library covers common detections, and your team can add its own rules. A rule can raise an alert, deliver the finding to a SIEM, push the domain to a block list or request a Takedown. Network Enforcement sends flagged domains to gateways, endpoints, mail filters and a hosted domain feed. ^{12–15,19–20,23,42–46}

Teams that prefer scripts can also reach the hosted product from code. The Public API streams lookalike lookups, unregistered-name lookups, domain analysis and certificate transparency search as NDJSON, under scoped API keys, and a Python SDK wraps it. The MCP server works with clients such as Claude and Cursor, and a separate Slack app brings the same work into chat. Writes through MCP or Slack need an organization admin plus the tool's scope, and Slack writes wait for Approve or Deny. ^{14,18,31–32,47–51}

Managed Takedowns sit on the same cases. An analyst reviews every request and reports the domain to its host and registrar, then escalates to ICANN and regional CSIRTs where necessary. The service stops short of legal action and can introduce legal partners. No public documentation of a URLCrazy takedown service was found. ^{1–2,12,24–25,30,52}

Where URLCrazy is the better choice#

URLCrazy fits when local control matters more than a hosted watch. It installs with no service account and no listed price, skips DNS with -r when you only need names, and keeps search-engine popularity requests off unless you pass -p. You can read the Ruby sources, edit the bundled prefix and suffix dictionaries, and pipe CSV or JSON into your own scripts. ^1–4,7–10

Its generators reach past keyboard typos in one pass. The -k option selects QWERTY, AZERTY, QWERTZ or Dvorak. Common Misspellings uses a list from Wikipedia and Homophones uses bundled sets of words that sound the same, while Singular or Pluralise runs the name through the Rails Inflector. Bit Flipping, ASCII homoglyphs and keyword prefixes and suffixes add more variants. Wrong TLD walks a bundled list of 1,513 TLDs, and All SLD adds country second-level domains. ^{1–2,7,27,30,35–36,53–54}

The project has a long record. The README dates its first publication to 2009, and Andrew Horton maintains it. Kali Linux packages it as a domain typo generator, and Repology lists packages for Kali, Parrot and BlackArch and in the AUR. That record suits a security engineer on a penetration test, an independent researcher, or a team that already runs its own scheduling and response. ^{1,3–5,30,55–57}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when you need to detect which typos someone has registered, investigate what they serve and respond to the malicious ones. Typo lookalikes are one way into the attack infrastructure behind them, and managed Takedowns report each malicious domain to its host and registrar. Each lookalike can carry RDAP registration data, with registrar, dates, status and abuse contact, beside hosting, open ports, the SMTP banner and a screenshot. When a lookalike serves a page, an analyst can open it in a live, isolated browser session. Discover lists the unregistered permutations separately. ^{11–18,24–26,32,52}

The check repeats without a scheduler of your own. Domain Monitoring watches every domain you add continuously, and it draws on certificate transparency and newly registered domains as well as generated permutations. Rules from the maintained library or your own turn a match into an alert, a Slack or webhook notification, a SIEM event, a block or a Takedown request that an analyst reviews. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, while Takedowns and the blocking, email and SIEM products are added through sales. ^{12–15,19–24,26,58}

For a one-off check, free ad-hoc lookups and the no-login Analyzer need no subscription. Have I Been Squatted is a hosted product, so it does not suit a team that must keep the scanner fully offline with no vendor account. It does not monitor social media, app stores, the dark web, ads or leaked credentials. ^{14,31–32,48,59–62}

FAQ#