Integrations

Connect your security stack,
respond everywhere

Connectors bring in mail and network data, and send every response to your SIEM, chat, endpoints and gateways, all from one rule.

Book a demo

How it works

Detect once,
act everywhere

Findings from across Have I Been Squatted build a single case. A rule matches them, raises a single alert and runs every response you configured across your connectors.

Connectors

Connectors for every layer,
from email to endpoint

An organization admin connects each one from the dashboard.

Email

Spot malicious senders and links in your mail, and quarantine the messages.

Cloudflare Email Security

Block mail from IOC domains that rules cite through Cloudflare Email Security blocked senders

Microsoft 365 Quarantine

Quarantine mail from and linking to flagged lookalike domains with expiring Exchange Online sender and URL blocks

Microsoft 365

Ingest domain-level email telemetry from Microsoft 365 tenants

Google Workspace

Read Gmail headers across your Workspace to find mail from lookalike domains

Mimecast

Block mail from malicious domains in Mimecast when a rule cites them

Coming soon

Proofpoint

Block mail from malicious domains in Proofpoint when a rule cites them

Coming soon

Security Operations

Send findings to your SIEM in its native format, ready to search and correlate.

Splunk Enterprise and Cloud

Export key findings to Splunk via the HTTP Event Collector (HEC)

Google Security Operations

Export rule-driven findings to Google SecOps as Unified Data Model events

Elastic Security

Write rule-driven findings to an Elasticsearch data stream as ECS documents

Microsoft Sentinel

Export rule-driven findings to a Log Analytics table and add cited lookalike domains to Sentinel threat intelligence

Endpoint

Detect or block malicious domains on every managed device.

Microsoft Defender for Endpoint

Block flagged lookalike domains on managed devices with Defender indicators

CrowdStrike Falcon

Raise Falcon detections when hosts resolve flagged lookalike domains, with custom IOCs

Huntress

Act on malicious domains in Huntress when a rule cites them

Coming soon

Network

Block malicious domains at your gateways, firewalls and DNS resolvers.

Cloudflare Zero Trust

Push flagged domains to a dedicated Cloudflare Gateway list for network enforcement

Zscaler Internet Access

Block flagged domains for every Zscaler user with a dedicated IOC URL category and block rule

iboss

Block IOC domains that rules cite in a dedicated iboss policy layer

Microsoft Defender

Read Defender for Endpoint connections and blocks to see which lookalike domains your devices reach

Cloudflare Gateway

Read Cloudflare Gateway DNS analytics to see which lookalike domains your users resolve and which ones Gateway blocked

Domain feed

Publish IOC domains that rules cite as a feed your firewalls and DNS resolvers fetch, such as Palo Alto, Fortinet and Check Point

Notifications

Send alerts to the channels your team already uses.

Slack

Receive alerts and interactive notifications in Slack channels

Microsoft Teams

Get notified in Microsoft Teams channels

Coming soon

Automation

Send signed events to any HTTP endpoint, or run ready-made workflows in Tines.

Webhooks

Deliver real-time events to any HTTP endpoint with signed payloads

Tines

Use Tines workflows to enrich and automate domain investigations

AI agents

Ask about malicious domains, alerts and Takedowns from your AI agent.

MCP

Connect AI agents such as Claude, ChatGPT, Cursor and GitHub Copilot. Your agent investigates malicious domains and acts on them with your permissions.

  • ChatGPT
  • Claude
  • Copilot
  • Cursor
  • GitHub Copilot

FAQ

Frequently asked questions

Abusive infrastructure,
disrupted

Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.

Book a demo