Simple,
transparent pricing
Straightforward pricing that scales with your attack surface protection needs.
Pro
For solo analysts. Monitoring and hunting.
(2 months savings when billed annually)
- Assistantin ChatGPT, Claude, Copilot and SlackNewDetect, investigate and respond from the dashboard, Slack or any MCP client.
- Hunting toolsRun ad-hoc Typosquat, Analyze and Discovery lookups to find targeted threats
- Domain MonitoringContinuously monitor domains with automated lookups and alerts.
- Data ExplorerExplore the data behind the scenes.
- DiffsCompare domains and their data.
- Rules and alertsDefine rules on monitored data and receive alerts when a rule triggers.
- Lookup APIsAccess our streaming lookup APIs.
- Standard supportGet help when you need it via in-app chat or email.
Business
Most popularFor cross-functional security teams. Governance and collaboration at scale.
(2 months savings when billed annually)
- Everything in pro planAll features from the pro plan are included
- ReportingAccess detailed reports on your domain monitoring activity.
- Organization managementAdd multiple users and roles to your Organization for centralized management.
- Slack, Teams, and Webhook connectorsRoute alerts and events to Slack channels, Microsoft Teams, and custom HTTP endpoints.
- Google, Microsoft 365 SSOCentralize sign-in through your identity provider.
- Audit loggingTrack all actions taken in your organization.
Enterprise
For enterprise security teams. Threat intelligence and managed response.
Billed monthly / quarterly / annually
- Everything in business planAll features from the business plan are included
- Managed Threat IntelligenceAccess to our managed Threat Intelligence service.
- SOAR connectorConnect with tools like Tines to enrich and automate threat intelligence workflows.
- SAML/EASIE SSO, SCIM directory syncFederate access with SAML or EASIE single sign-on and automatically provision users via SCIM.
- Priority supportFaster response times and dedicated support via Email, Slack, or Teams.
Extend coverage beyond core monitoring
Optional capabilities for Enterprise and specialized programs. Mix add-ons with your plan as requirements grow.
Add-on
Email Intelligence
Connect Microsoft 365 and Google Workspace to correlate sender domains with domain risk scoring. No MX changes required.
Add-on
Security Operations
NewStream detections and alerts into your SIEM as they happen, so analysts triage lookalikes next to the rest of their signals.
Recent detections, each sent to a connected SIEM.
Add-on
Site Canaries
Detect cloned and phishing copies of production pages with a small embedded JavaScript snippet.
Free
Browser Protection
Warn users when they reach lookalike or flagged domains in the browser, with policy controls your security team can tune.
Add-on
Network Enforcement
Block malicious domains across your secure web gateway, endpoints and mail the moment a rule flags them.
Trusted by 700+ organizations
Pick your plan
Pricing that scales to cover your attack surface.
Try a 14-day free trial.
Agents
Assistant
Detect, investigate and respond from the dashboard, Slack or any MCP client.
Monitoring & hunting
Hunting tools
Run ad-hoc Typosquat, Analyze and Discovery lookups to find targeted threats
Domain Monitoring
Continuously monitor domains with automated lookups and alerts.
Data Explorer
Explore the data behind the scenes.
Diffs
Compare domains and their data.
Rules and alerts
Define rules on monitored data and receive alerts when a rule triggers.
Lookup APIs
Access our streaming lookup APIs.
Collaboration & governance
Reporting
Access detailed reports on your domain monitoring activity.
Organization management
Add multiple users and roles to your Organization for centralized management.
Audit logging
Track all actions taken in your organization.
Google, Microsoft 365 SSO
Centralize sign-in through your identity provider.
Connectors
Slack, Teams, and Webhook connectors
Route alerts and events to Slack channels, Microsoft Teams, and custom HTTP endpoints.
SOAR connector
Connect with tools like Tines to enrich and automate threat intelligence workflows.
Add-ons
Email Intelligence
Correlate sender domains in Microsoft 365 and Google Workspace with domain risk, without changing MX records.
Site Canaries
Detect cloned and phishing copies of your production pages with a small embedded snippet.
Security Operations
Stream detections and alerts into Splunk, Google SecOps, Elastic and Microsoft Sentinel.
Network Enforcement
Block malicious domains in Zscaler, Cloudflare Zero Trust, CrowdStrike, Microsoft Defender, iboss and a hosted domain feed.
Domain Takedowns & Response
Managed takedown and disruption of malicious infrastructure through targeted response
Enterprise & support
Managed Threat Intelligence
Access to our managed Threat Intelligence service.
SAML/EASIE SSO, SCIM directory sync
Federate access with SAML or EASIE single sign-on and automatically provision users via SCIM.
Standard support
Get help when you need it via in-app chat or email.
Priority support
Faster response times and dedicated support via Email, Slack, or Teams.
Assistant
Detect, investigate and respond from the dashboard, Slack or any MCP client.
Hunting tools
Run ad-hoc Typosquat, Analyze and Discovery lookups to find targeted threats
Domain Monitoring
Continuously monitor domains with automated lookups and alerts.
Data Explorer
Explore the data behind the scenes.
Diffs
Compare domains and their data.
Rules and alerts
Define rules on monitored data and receive alerts when a rule triggers.
Lookup APIs
Access our streaming lookup APIs.
Reporting
Access detailed reports on your domain monitoring activity.
Organization management
Add multiple users and roles to your Organization for centralized management.
Audit logging
Track all actions taken in your organization.
Google, Microsoft 365 SSO
Centralize sign-in through your identity provider.
Slack, Teams, and Webhook connectors
Route alerts and events to Slack channels, Microsoft Teams, and custom HTTP endpoints.
SOAR connector
Connect with tools like Tines to enrich and automate threat intelligence workflows.
Email Intelligence
Correlate sender domains in Microsoft 365 and Google Workspace with domain risk, without changing MX records.
Site Canaries
Detect cloned and phishing copies of your production pages with a small embedded snippet.
Security Operations
Stream detections and alerts into Splunk, Google SecOps, Elastic and Microsoft Sentinel.
Network Enforcement
Block malicious domains in Zscaler, Cloudflare Zero Trust, CrowdStrike, Microsoft Defender, iboss and a hosted domain feed.
Domain Takedowns & Response
Managed takedown and disruption of malicious infrastructure through targeted response
Managed Threat Intelligence
Access to our managed Threat Intelligence service.
SAML/EASIE SSO, SCIM directory sync
Federate access with SAML or EASIE single sign-on and automatically provision users via SCIM.
Standard support
Get help when you need it via in-app chat or email.
Priority support
Faster response times and dedicated support via Email, Slack, or Teams.
Pro
Business
Enterprise
Pro
Business
Enterprise
FAQ
Frequently asked questions
Abusive infrastructure,
disrupted
Have I Been Squatted helps security teams detect infrastructure targeting their organization, investigate it with evidence, and coordinate takedowns.