Have I Been Squatted vs urlinsane

• Choose urlinsane for a free, open-source CLI you run yourself, with release 0.8.2 for domain typos or an unreleased source build for package and username checks and a CI exit-code gate. ^1–15
• Choose Have I Been Squatted to detect and respond to malicious domains, with a legitimate, parked or phishing classification, RDAP registration data and a screenshot where available, plus rules, connectors and managed Takedowns. ^10,16–32
• Use both if a source build of urlinsane gates dependency names in your pipeline while Have I Been Squatted owns continuous monitoring and response for the domains your organization protects. ^{4–5,8–9,17–18,25}

At a glance#

Have I Been Squatted and urlinsane on the decisions a buyer weighs first; urlinsane cells marked source build describe unreleased source rather than release 0.8.2.

	Have I Been Squatted	urlinsane
What you get
What you get	Detection and response for malicious domains16	Local CLI that generates and observes name variants1–5
How you run it
How you run it	Scheduled hosted lookups23	One-shot CLI; schedule with cron or CI2,4,33
Lookalike discovery
Lookalike discovery	Permutations, certificate transparency, newly registered domains, business context18,23	Generated variants of one target, then observed1–2,34
Names beyond domains
Names beyond domains	Domains18,23	Source build: email, package and username variants; package and username checks1,10–15
After a scan
After a scan	Alerts, SIEM delivery, blocking, annotation, Takedown requests25–26,35–37	Source build: exit-code gate and deterministic exports2,4
Takedown handling
Takedown handling	Managed Takedowns with analyst review31	Not found2,38–39
How you get it
How you get it	Self-serve monitoring subscription17,23	Open source and free1–5

A local CLI versus a hosted monitor#

urlinsane is a GPL-3.0 Go command-line tool that you install and run on your own machine, and the build you install decides what it does. The newest published release, 0.8.2, is a pre-rewrite pipeline with collectors for DNS, GeoIP, screenshots, redirects, banners and content fuzzy hashing, with WHOIS marked TODO. A source build, from a clone or go install, is the only route to the rewritten engine on unreleased master. That engine adds WHOIS, package and username checks, rule-based scoring and campaign clustering, and it drops the screenshot, redirect, banner and fuzzy-hash collectors. Its CLI reference marks several specified flags and views, including --resume and graph diffing, as not built yet. ^{1–15,39–47}

Have I Been Squatted is a hosted platform that monitors your domains for you. Domain Monitoring runs automated lookups on a schedule and alerts on what it finds. Discovery combines generated lookalikes with certificate transparency and newly registered domains. Each result carries enrichment your analysts can review, and rules turn observations into alerts, SIEM delivery, blocks and Takedown requests. ^{10,17–19,23,25–26,35,48}

What happens after a scan#

urlinsane scans one target per run and leaves scheduling, alert delivery and cross-scan comparison to the systems your team already runs. No public documentation of a built-in scheduler, alert delivery, case state, suppression lists or named SIEM and chat integrations was found. The automation guide instead shows weekly cron and GitHub Actions recipes that call the binary and pipe its output into shell tools. On a source build, output comes as table, JSON, NDJSON, CSV or Graphviz DOT. There, --fail-on exits with code 2 when a finding reaches a severity you set, which suits a CI gate on a dependency name. ^{1–2,4,33,43}

A source build also keeps scan history on your machine. --save-graph stores each scan locally, report --scans lists the saved scans of a target, and report replays one without network work. A built-in graph diff is designed but not wired up, so the guide compares two scans with a manual diff of their CSV renders. ^1–2,4

Picture a security engineer whose weekly scan finds exmaple.com live with a mail record. With urlinsane, the team owns result storage, comparison and the handoff to response, whether it scripts those steps or runs them by hand. The deterministic exports can feed that workflow. The defending guide describes registrar abuse reports and UDRP complaints as actions for the reader to take. ^{1–2,4,38–39,41,46}

Have I Been Squatted keeps that work in the product. Scheduled lookups continue after you add a domain. Rules from a maintained library or your own raise alerts, deliver findings to a SIEM, push domains to gateways and a hosted domain feed, or request a Takedown. An analyst reviews every Takedown request and reports the domain to its host and registrar. An MCP server and Slack app let agents work the same cases, with admin-gated writes. ^{10,17,19,23,25–32,35,49–54}

Domain protection

Detect adversary infrastructure while it is being staged.

Have I Been Squatted helps security teams detect lookalike domains, certificate and DNS changes, and staging infrastructure, investigate the evidence, and coordinate takedowns.

Start free trialExplore domain protection

Discovery coverage and evidence for triage#

urlinsane generates variants of one target and checks which exist. On a source build, its 32 algorithms range from typo-family edits, bitsquats, homoglyphs, combosquats and TLD swaps to multilingual homophones and names under delegated-subdomain hosts such as duckdns.org. The same build varies email addresses, packages, usernames and repository names, and checks package and username existence against bundled source lists. It flags a dependency-confusion finding when a package name that is not a variant is confirmed absent. Repository-name variants are generated, but the bundled checks do not determine whether a repository path exists. ^{1–2,10–15,33–34,39,55–65}

On a source build, observation covers live DNS, WHOIS, reverse DNS and GeoIP when you supply a database. Existence is three-state. A name is live, absent or unknown, so a failed lookup never reads as a free name. A scoring analyzer ranks live variants, and a campaign analyzer reports when two or more variants share an address, nameserver or registrant inside one scan. The project's documentation, which states that every command and output in it was run against the binary, shows this scan of character swaps of example.com, shortened here to three findings and the summary. ^{1–2,6,11–12,39,41–47,66–68}

$ urlinsane typo -a cs -d 1 example.com
…
FINDINGS
  HIGH    live-variant  eaxmple.com is live: [resolves accepts mail]
  HIGH    live-variant  exmaple.com is live: [resolves accepts mail]
  MEDIUM  live-variant  examlpe.com is live: [resolves]
  …

137 nodes  184 edges  38 live  12 absent  0 unknown
4 rounds in 42.87s

In this example, HIGH accompanies live variants that resolve and have a mail record. The score is a rule-based count of DNS facts, so it ranks names for review. No public documentation of a content or phishing classifier was found in urlinsane, so review a HIGH name before you decide on a response. ^{12,39,41,46–47}

Have I Been Squatted puts that review evidence on each result. Discovery adds certificate transparency and newly registered domains to permutations such as omission, bitsquatting, homoglyph, keyword and TLD swaps. Enrichment covers RDAP registration data, ASN and hosting, mail readiness, open ports, redirects, HAR and DOM capture, screenshots and an isolated browser session. A first-party model classifies each result as legitimate, parked or phishing, with a confidence score. No public documentation of a newly registered domain feed or certificate transparency monitoring was found in urlinsane scans. ^{2,10,18–25,39,69–71}

Where urlinsane is the better choice#

urlinsane fits when you need a free local engine you can read, change and run without a vendor account. Public GPL-3.0 source and the release binaries need no account or service quota. A source build adds multilingual generation across 32 algorithms, delegated-subdomain forms, package and username existence checks, three-state existence, and campaign clustering with Graphviz output. Its deterministic exports and --fail-on exit code suit CI, and the documentation book walks through the attack and the engine. ^{1–5,7,10–15,33,43,47,55,58–61,64–65,72–73}

That profile suits a security engineer, researcher or small team that already owns scheduling, storage and response. It also suits a team that watches for supply-chain attacks and can build from source to get package and username squatting checks beside domain typos. The project states that the tool is primarily intended for Linux. ^{1–2,4–5,8–15}

Where Have I Been Squatted is the better choice#

Choose Have I Been Squatted when you want to detect malicious domains and the infrastructure behind them, with registration, page and verdict evidence together and no choice between a release and a source build. Each lookalike can carry RDAP registration data, hosting, mail readiness and open ports, plus redirects, HAR and DOM capture and a screenshot. A first-party model labels it legitimate, parked or phishing with a confidence score. When the lookalike serves a page, an analyst can open it in a live, isolated browser session. ^{10,16,18–25}

The schedule and the response live in the product, so your team maintains no scheduled job or CI recipe for them. Domain Monitoring watches each domain you add continuously, using certificate transparency and newly registered domains as well as permutations. Rules from the maintained library, or your own in the Upsilon query language, raise alerts, send findings to a SIEM, push domains to gateways or a hosted domain feed, or request an analyst-reviewed Takedown. ^{10,17–19,23,25–31,35}

Investigations can also reach past a single scan. Atlas investigations, in early access, start from a described hunt and any domains you already suspect, pivot across shared infrastructure in a store of domain observations and keep watching after the first pass. Results appear in views such as Tree, Table, Clusters and Flows, and export to formats including STIX 2.1 and CSV. ^{32,53,74–78}

Scripts keep a way in. The Public API streams lookalike lookups, unregistered-name lookups, domain analysis and certificate transparency search as NDJSON, with scoped API keys and a Python SDK. Monitoring, hunting tools, rules and alerts are self-serve with a free trial, and Takedowns and the blocking, email and SIEM products are added through sales. ^{17,19,22–23,50–51,79–81}

Have I Been Squatted does not suit a buyer who only needs a one-shot scan they can finish with urlinsane, or who needs to run a scanner locally without a hosted vendor account. It is a hosted product. Have I Been Squatted does not monitor social media, app stores, the dark web, ads or credential leaks. ^48,82–83

FAQ#