Have I Been Squatted

Have I Been Squatted catches attacker infrastructure as it is being built and shuts it down across every control our customers run. Lookalike domains, mail servers, staging hosts and their certificates often appear before a phishing campaign launches. We find them, collect the evidence and drive the response through the controls you already operate.

This connector brings that intelligence into Claude.

Enrich and hunt, for any domain:

• Analyze a domain from an alert, email or ticket: DNS and IPs, mail records, registration, hosting, ASN and location, HTTP response, technologies, open ports, known vulnerabilities, classification and a verdict. Seconds for a cached verdict, up to a few minutes for a full live pass.
• Search certificate transparency: match new certificate names against a pattern such as "examp[l1]e", often before the host serves anything.
• Hunt typosquats: generate permutations of a domain and find which are registered or live. Typically 5–10 minutes.

Work your organization's detections:

• Query infrastructure found for your monitored domains, email and websites. Enrich mail records, registration, hosting, open ports, redirect chains, and what a page asks visitors for, such as passwords, one-time codes or wallet recovery phrases.
• Triage: manage your results, such as tagging detections as owned or malicious. The tag persists when the domain resurfaces.
• Find unregistered lookalikes an attacker could still register, so you can take them first. Paid plans.

Long lookups run in the background; Claude tells you one has started and checks back for results.

Try asking:

• "Enrich every domain in this phishing report and rank them by risk."
• "Which lookalikes found this week already have mail servers set up?"
• "Can you help me analyze this domain"
• "Has Have I Been Squatted seen this domain before?"

Requires a Have I Been Squatted account with an organization; every call is limited to the organization you connect. Detections require a paid plan.