Have I Been Squatted?
Tool Description : Checks whether a domain has been registered as a typo-squatted or lookalike site.
Have I Been Squatted?
Quick Overview
What it does
Scans domains for typo-squatting risks and impersonation variants and flags suspicious lookalike websites that could be used for phishing or fraud.
How to use it
Enter a domain, review generated lookalikes, then assess risk.
Cost
Free.
Account required
No for basic functionality. Yes for full results.
Cookies
Mainly support user authentication, session management, and analytics tracking.
Ownership
Owned and operated by a small independent team led by its co-creators Juxhin Dyrmishi Brigjaj and Ian Muscat.
Use in Reporting
Mapping threat infrastructure, identifying impersonation risk, and building evidence-based reporting around phishing and fraud ecosystems.
What does Have I Been Squatted do?
Have I Been Squatted helps you identify whether a domain has been “squatted”, meaning someone has registered a lookalike version of a legitimate domain. These are often used in phishing campaigns, scams, or brand impersonation attempts.
It works by generating or checking variations of a domain name (such as misspellings, swapped characters, added words, or different extensions) and comparing them against known or detected registrations. The goal is to quickly surface domains that could confuse users into trusting a fake site.
The lowdown: It’s a quick, simple OSINT tool for spotting typo-squatted and impersonation domains, best used as an early warning system in phishing and brand protection investigations.
How to Use:
1. Enter a domain name (e.g. example.com) and review results.
Note: Look for misspellings, added hyphens, or alternative extensions.
The ‘Analyze’ tool lets you see further website and infrastructure analysis including domain status, DNS records, and registration metadata:
2. Assess risk level by checking whether suspicious variants could be used for phishing, fraud, or impersonation.
Cost
Data Processing
Account Required:
Cookies:
Cookies mainly support user authentication, session management, and analytics tracking for the site. They include login/session tokens (Clerk), customer support and chat tracking (Intercom), and usage analytics (PostHog).
Use in Reporting
Have I been Squatted is useful for:
Identifying phishing infrastructure.
Checking impersonation risk of brands or organisations.
Supporting cybercrime and fraud investigations.
Documenting malicious domain registration patterns.
For example, Security teams can proactively check their organisation’s domain to see what attackers might already have registered, helping domain monitoring strategies, defensive domain registration, and alerting incident response teams early.
As another example. researchers can aggregate squatting patterns across sectors (finance, shipping, government services) to show which industries are most targeted, how naming tactics evolve over time, and emerging phishing trends.
In practice, the tool isn’t just about spotting “fake domains”, it’s a starting point for mapping threat infrastructure, identifying impersonation risk, and building evidence-based reporting around phishing and fraud ecosystems.
Capabilities
Limitations
Generates typo-squatted domain variations.
Doesn’t guarantee malicious intent of a domain.
Helps identify potential phishing or scam domains.
May produce false positives (e.g. legitimate parked or unused domains).
Quick, lightweight checks for brand impersonation risk.
Limited context beyond domain similarity.
Useful for early-stage cyber threat detection.
Not a full threat intelligence platform.
Requires further verification using additional OSINT tools.
Summary
Have I Been Squatted is particularly useful in OSINT workflows when you’re trying to map out threat infrastructure or check whether a brand is being targeted by impersonation.
Ownership
Have I Been Squatted is owned and operated by a small independent team led by its co-creators Juxhin Dyrmishi Brigjaj and Ian Muscat, through their company Have I Been Squatted Inc.
Ethical Considerations
Domains flagged as “suspicious” are not automatically malicious.
Always verify before attributing intent to domain owners.
Avoid publishing unverified accusations of fraud.
Use responsibly in cybersecurity and investigative contexts.
Respect privacy and avoid targeting non-malicious domain holders.
Related Tools:
VirusTotal domain analysis
SecurityTrails
Sources
https://haveibeensquatted.com/
https://haveibeensquatted.com/about/terms
Last updated
Was this helpful?