Find malicious domains and URLs
across your enterprise mail
Attackers often reach your inbox before any threat feed knows their domain exists. Email Intelligence turns that first email into your first warning.
How it works
Keep the signal,
drop the content
All the early warning your mail can give, none of the privacy risk. Have I Been Squatted reads domains, file hashes and metadata from Microsoft 365 or Google Workspace, and never stores a subject, address, body or full URL.
Response
Quarantine,
on autopilot
The same rule can also send the finding to your SIEM and any other connector.
Quarantine setup guideSources
No MX records to set up,
nothing in your mail flow
An API-only connection to Microsoft 365 or Google Workspace that reads metadata, never message content. No MX changes, no deliverability issues, and setup takes minutes, with zero risk to your mail flow.
Microsoft 365 Advanced Hunting
Mail telemetry from Microsoft Defender, including linked domains and attachment hashes.
- Signals
- Sender, recipient and URL domains, attachment hashes
Exchange Message Trace
Coverage for Microsoft 365 tenants without Advanced Hunting, from Exchange message traces.
- Signals
- Sender and recipient domains
Google Workspace
Malicious senders across Gmail, from the Workspace audit log.
- Signals
- Sender and recipient domains
FAQ
Frequently asked questions
Abusive infrastructure,
disrupted
Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.