Have I Been Squatted

Have I Been Squatted finds attacker infrastructure while it is being set up. Lookalike domains, mail servers, staging hosts and their certificates often appear before a phishing campaign launches. This plugin brings detection, investigation and response for them into ChatGPT and Codex.

Enrich and hunt, for any domain

• Analyze: live DNS, mail, registration, hosting, HTTP and classification for one domain, with a verdict profile and an interactive view with a screenshot and hosting map. Fast depth takes under a minute; slow depth renders the page and reports what it asks visitors for, such as passwords, one-time codes or payment data.
• Certificate transparency search: find certificate names matching a pattern, such as lookalike spellings of your brand, with the last time each was seen. Answers immediately.
• Typosquat scan: generate permutations of a domain and check which are registered or live, ranked by evidence. Typically 5 to 10 minutes.
• Discover: find unregistered lookalikes of a domain that could still be registered defensively.

Work your organization's detections

• Query: search lookalikes found for your monitored domains, and Email Intelligence and Site Canary events, from the last 30 days. The model reads the field catalog before writing a query, so you can ask in plain language.
• Alerts: review the alerts your detection rules raised, the evidence each cites and whether each response reached its destination, then resolve, ignore or mark them false positive.
• Results: tag a result as owned, ignored, false positive or malicious; the tag carries over to later results for the same domain. Add a domain you analyzed to a monitored domain's results.
• Rules: list, validate, create, update, enable, disable and delete detection rules and the responses they trigger in your connected tools.
• Responses: send one result to a connected tool now, outside any rule, such as a SIEM finding, a Slack message or a block in Microsoft Defender or Cloudflare Gateway, and check that it was delivered.
• Monitored domains: list, add, tune and remove the domains you monitor.
• Takedowns: open a managed takedown case for a malicious domain, follow its timeline, add updates and link related alerts.

Background jobs Scans and deeper analyses take longer than a single reply. They start a background job and return straight away; ask for the status later in the conversation to get ranked results. Jobs expire after 24 hours, and each organization runs three at a time.

Changes Tools that change your organization's data need an organization admin, and ChatGPT asks you to confirm each one. Takedown cases are reviewed by the Have I Been Squatted operations team before any report reaches a registrar or host. Sending a response changes your own security tools; the monitored domain itself is never blocked. Removing a monitored domain or deleting a rule cannot be undone.

Example prompts

• "Show this week's lookalike detections for my organization and group them by monitored domain."
• "Which alerts are still active, and did their Splunk responses get delivered?"
• "Analyze secure-examp1e-login.com and tell me whether it is live and what it is hosting."
• "Create a rule that alerts on lookalikes of example.com within one character that ask visitors for a password."

Access requirements

• Requires a Have I Been Squatted account. You sign in with OAuth and choose which organization to connect; every call is scoped to that organization and to your role in it.
• Lookups work for every account. Organization tools need domain monitoring, and querying detections needs at least one monitored domain with a completed scan.
• Email Intelligence, Site Canary and Takedowns tools work when those features are enabled for your organization; the plugin lists only the tools your organization can use.