Questions and answers
in one place
How Have I Been Squatted finds and responds to malicious domains, what each plan includes, and how your data is handled.
What is Have I Been Squatted?
Have I Been Squatted detects lookalike domains and other attack infrastructure targeting your organization. It investigates the evidence and manages the response, from alerts and network blocks to Takedowns.
What types of typosquatting does Have I Been Squatted detect?
Character omissions, additions, substitutions and transpositions, homoglyphs, other TLDs and more. Have I Been Squatted generates these permutations with its open-source engine, twistrs, and checks which ones are registered. It also finds lookalikes in new registrations and certificate transparency logs.
Is there a free plan?
Yes. The Basic plan is free, forever, with lookups from the dashboard or your agent. New organizations also start with a 14-day free trial.
How quickly are alerts sent?
Email and network activity is checked against your rules in near real time, and an alert is raised on the first match. Email Intelligence picks up new mail every 3 minutes. Lookalike domains raise an alert as soon as an analysis finds a matching result. Each monitored domain is checked at least once every 24 hours, and you can run a lookup at any time in between.
Does Have I Been Squatted handle domain takedowns?
Yes, with the Takedowns add-on for Enterprise. The team gathers the evidence and reports the domain to the registrar or hosting provider, and a rule can request Takedowns automatically. Have I Been Squatted does not take legal action, but can connect you with third-party legal providers at preferential rates.
What integrations are available?
Connectors cover your SIEM, email, endpoints and network, plus Slack, Microsoft Teams, Tines and webhooks. To request a connector, contact us.
How does Have I Been Squatted handle data privacy and security?
Customer data is stored and processed in the United States. Data in transit uses TLS 1.2 or higher, and stored data is encrypted at rest. Sign-in supports multi-factor authentication, and enterprise customers can use single sign-on. The Security page and the Privacy Policy have the details.
Which plans include Domain Monitoring?
Every plan from Pro up. Pricing is per monitored domain.
How often are lookalikes checked?
At least once every 24 hours, starting minutes after you add a domain. Run as many ad hoc lookups as you like in between.
What is checked for each lookalike?
Registration, DNS and mail records, the web page with its redirects and screenshot, open ports, technologies, certificates, a classification and more.
How are lookalikes classified?
As legitimate, phishing or parked, each with a confidence score.
What about lookalikes I own?
Mark them "Owned", and your rules skip them.
Can I add many domains at once?
Yes, import a CSV with each domain, its business context and its properties.
What happens after an alert?
Each rule runs the actions you configure for it. Notify your team, send the finding to your SIEM, block the domain on your network or request a Takedown.
Who does the takedown work?
We do. Our team gathers the evidence, finds who can act on the domain and reports it to them. An analyst reviews every request before anything is reported.
How long does a Takedown take?
With sufficient evidence, the registrar or hosting provider usually responds within 4 hours. Depending on the case, a response can take up to 24 or 72 hours. Requests that are not domain abuse are handled case by case. The case shows every step as it happens.
What if a registrar or hosting provider doesn't respond?
We keep following up until the case reaches an outcome, escalating to ICANN and regional computer security incident response teams (CSIRTs) where necessary.
Can a rule request Takedowns automatically?
Yes. Add "Request takedown" to a rule and it opens a case for each domain the rule flags. If the domain already has an open case, the request joins it.
Which plans include Takedowns?
Takedowns are an Enterprise add-on.
Which plans include Site Canaries?
Site Canaries are an Enterprise add-on.
Does a flagged page load prove the site is malicious?
Typically, yes. Site Canaries have a virtually zero false positive rate. Ignore the hosts you expect page loads from, such as staging domains or other domains and subdomains you own.
Can a cloned site avoid the Site Canary?
Technically, yes, if an attacker knows to look for it. In practice, attackers typically copy the entire site, scripts and all.
Do I need to change my Content Security Policy?
Only if your site sets one. Allow https://c.hibs.me in script-src-elem, or in script-src when that directive is absent. The Site Canaries guide covers nonce-based policies and Trusted Types.
How do I rotate a Site Canary deployment?
Archive it, create a replacement and put the new script tag on the page. An archived deployment cannot be restored.
Which plan includes Email Intelligence?
Email Intelligence is an Enterprise add-on. The Quarantine in Microsoft 365 response also needs the Network Enforcement add-on.
Does Have I Been Squatted read message content?
No. Have I Been Squatted has no permission to read mailboxes, so message bodies and attachments are never accessible. Subjects, full addresses and full URLs are dropped before anything is stored.
Does Email Intelligence block mail?
Not by default. To quarantine mail from malicious domains, connect Microsoft 365 Quarantine and add its response to a rule. Quarantine requires the Network Enforcement add-on.
How soon do email observations appear?
Within 3 minutes of the provider recording them. Have I Been Squatted polls each provider every 3 minutes.
Which plans include Network Intelligence?
Network Intelligence is an Enterprise add-on. The team turns it on with you and connects your Microsoft tenant.
What does Network Intelligence need from Microsoft Defender?
Microsoft Defender for Endpoint with onboarded devices and Advanced Hunting, and admin consent for ThreatHunting.Read.All. It uses the same Microsoft app as Email Intelligence.
Does Network Intelligence change anything in Defender?
No. It reads Defender through read-only Advanced Hunting queries. Blocks in Defender for Endpoint come only from the responses you add to a rule, through their own connection.
What can a network rule do when it matches?
Raise an alert, notify Slack, your SIEM or a webhook, and request a Takedown. It can also block the domain in your controls, such as Defender for Endpoint, Cloudflare Zero Trust and Zscaler Internet Access.
Does Network Intelligence record which device connected?
No. Counts are per destination, per hour. Hosts and IP addresses are samples of what was reached.
For how long is network traffic kept?
90 days, stored as the number of connections to each destination in each hour.
Does connecting a network control block anything?
No. A control blocks only the domains your rules flag or your team sends by hand.
Could our own domains end up blocked?
No. Your monitored domains and their subdomains never go into a block list.
Do blocks expire?
Gateway and endpoint blocks never expire, so a domain can't slip back in just before attackers reuse it. Microsoft 365 Quarantine blocks last 30 days and renew when a rule cites the domain again.
What if our firewall isn't listed?
Firewalls that fetch a list over HTTPS, such as Palo Alto, Fortinet, Check Point, Sophos and pfBlockerNG, can read the domain feed.
Which plans include Network Enforcement?
Network Enforcement is an Enterprise add-on.
What's in a Security Operations finding?
The rule that fired, its severity, the alert's status and the malicious domains it cites.
Do we have to write SIEM parsers?
No. Each SIEM gets the format it already reads, such as UDM events in Google Security Operations or STIX indicators in Microsoft Sentinel.
How do we know a finding reached our SIEM?
Every delivery records the provider's response. If one fails, the dashboard shows the provider's error.
Can analysts send a finding by hand?
Yes. Analysts and AI agents can send any domain from your results to a connected SIEM through the API or the MCP server.
Which plans include Security Operations?
Security Operations is an Enterprise add-on.
Which plans include connectors?
Slack, Microsoft Teams and webhooks come with the Business and Enterprise plans, and Tines with Enterprise. SIEM, email and blocking connectors come with the Security Operations, Email Intelligence and Network Enforcement add-ons for Enterprise.
Who can set up a connector?
Only organization admins can. Each connector's setup guide lists the permissions it needs in the connected product.
What does a connector send?
SIEM connectors receive rule findings and the domains they cite. Blocking connectors receive only the cited domains. Your own monitored domains are never blocked.
Does adding a connector block anything on its own?
No. A domain is blocked only when a rule you configure runs a blocking response.
What if my product isn't listed?
Use webhooks to send signed events to any HTTP endpoint, or publish cited domains as a domain feed that firewalls and DNS resolvers can read. To request a connector, contact us.
What can my agent do with Have I Been Squatted?
It can analyze a domain, scan for lookalikes and search certificate transparency. It can also manage your monitored domains, alerts, rules and Takedowns, and send a domain to a connected tool such as your SIEM or firewall. See the full tool catalog.
Does connecting a client give it access to my data?
Not on its own. The first time your agent calls Have I Been Squatted, you sign in and choose one organization. Your agent can reach only that organization, and your role and plan are checked on every request.
Can my agent change things without asking?
Changes need an organization admin. Have I Been Squatted marks every tool that changes data, and your client asks you to confirm those calls unless you turned confirmations off. In Slack, the app posts the exact change with Approve and Deny buttons and changes nothing until you approve.
What about prompt injection from a malicious page?
Domain results, page content and certificate names can come from attackers. Have I Been Squatted returns them as data and tells your agent never to follow instructions inside them. Changes still need an organization admin and your confirmation.
Is my agent's activity logged?
Yes. Every request is recorded with who made it, which app it came from and what it asked for.
Which plan does my agent need?
Lookups work on every plan, including the free Basic plan and trials. Monitoring, rules and alerts need a Pro, Business or Enterprise plan. Sending to Slack, Teams or a webhook needs Business or Enterprise; SIEM alerts, blocks and takedowns need their add-ons.
Do I need to be a security specialist to become a partner?
No. The MSP track is built for general managed service providers. The MSSP and SOC track is there if you want deeper security integration.
How do partners get paid or earn margin?
MSP and MSSP partners buy at wholesale and bill clients directly, keeping a recurring margin. Referral partners earn a commission on deals they introduce.
Who delivers the service to a partner's clients?
You do. You use the Have I Been Squatted platform to monitor your clients' domains and deliver the monitoring, triage, takedown coordination and reporting as your own managed service, at a fee you set.
How long does it take a partner to get started?
Most partners are enabled and running their first scans within hours.
What does it cost to join the partner program?
Nothing. There are no joining fees or minimum commitments to become a Registered partner.
Abusive infrastructure,
disrupted
Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.