Start
Start from any alert, link, case, or lookup with the same depth.
Threat intelligence
Turn a single indicator into the campaign behind it
A malicious domain is rarely alone. CT pivots, shared hosting, and content fingerprints connect assets into campaigns, with evidence ready for casework and referral.
The challenge
Why one indicator is never the whole story
Operators run at scale, and the signals that connect their assets sit in separate silos.
Operators work at scale
A single lookalike is one node in a campaign of dozens, staged across shared infrastructure you cannot see from one domain.
Signals live in silos
Certificates, hosting, registration, and content each tell part of the story, but only when they are connected.
Manual pivoting does not scale
Mapping a campaign by hand means tabs, spreadsheets, and lost links, exactly when speed matters most.
Intelligence surfaces
How the picture comes together
Pivot paths that turn a single indicator into a mapped operator footprint, delivered where your team works.
Related infrastructure
Shared autonomous system numbers (ASNs), name servers, IP ranges, and certificate subject alternative names (SANs) that tie separate domains to one operator.
Certificate transparency pivots
Brand-adjacent certificate issuances in CT logs, including hostnames that have not yet served content, an early signal before a campaign goes live.
Content and template fingerprinting
Reused phishing kits, login templates, logos, and page structure across domains. One visual match can surface dozens of sibling sites.
Feeds and API delivery
Structured indicators, campaign context, and enrichment delivered into SIEM, SOAR, and case tools through REST and streaming APIs.
Enrich
DNS, hosting, certs, and WHOIS in one record. Pivot without tab sprawl.
Cluster
Related domains grouped into one operator footprint.
Deliver
Reports for legal referral or campaign context into SIEM and SOAR.
Start
Start from any alert, link, case, or lookup with the same depth.
Enrich
DNS, hosting, certs, and WHOIS in one record. Pivot without tab sprawl.
Cluster
Related domains grouped into one operator footprint.
Deliver
Reports for legal referral or campaign context into SIEM and SOAR.
Most tools answer one question about one domain. Have I Been Squatted starts there and pivots through shared infrastructure, certificate issuance, and reused templates to surface the sibling sites, then sequences registration, hosting, and content changes into a timeline. The output is a campaign you can act on, not a row you have to research.
“This is awesome and provided me some great results. I've got legal going after a few on the list now.”
The platform
Beyond threat intelligence
Brand protection, domain security, phishing and fraud response, and threat intelligence. One intelligence layer, from first signal to action taken on your behalf.
Fortify your brand security today
Join cybersecurity professionals who trust Have I Been Squatted to protect their brands from threats.