> For the complete documentation index, see [llms.txt](https://tools.osintnewsletter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tools.osintnewsletter.com/osint-tools/have-i-been-squatted.md).

# Have I Been Squatted?

| **Have I Been Squatted?** | **Quick Overview**                                                                                                                                  |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| URL                       | <https://haveibeensquatted.com/>                                                                                                                    |
| What it does              | Scans domains for typo-squatting risks and impersonation variants and flags suspicious lookalike websites that could be used for phishing or fraud. |
| How to use it             | Enter a domain, review generated lookalikes, then assess risk.                                                                                      |
| Cost                      | Free.                                                                                                                                               |
| Account required          | No for basic functionality. Yes for full results.                                                                                                   |
| Cookies                   | Mainly support user authentication, session management, and analytics tracking.                                                                     |
| Ownership                 | Owned and operated by a small independent team led by its co-creators Juxhin Dyrmishi Brigjaj and Ian Muscat.                                       |
| Use in Reporting          | Mapping threat infrastructure, identifying impersonation risk, and building evidence-based reporting around phishing and fraud ecosystems.          |

### What does Have I Been Squatted do?

Have I Been Squatted helps you identify whether a domain has been “squatted”, meaning someone has registered a lookalike version of a legitimate domain. These are often used in phishing campaigns, scams, or brand impersonation attempts.

It works by generating or checking variations of a domain name (such as misspellings, swapped characters, added words, or different extensions) and comparing them against known or detected registrations. The goal is to quickly surface domains that could confuse users into trusting a fake site.

**The lowdown:** It’s a quick, simple OSINT tool for spotting typo-squatted and impersonation domains, best used as an early warning system in phishing and brand protection investigations.

### How to Use:

**1. Enter a domain name (e.g.** [**example.com**](http://example.com)**) and review results.**&#x20;

Note: Look for misspellings, added hyphens, or alternative extensions.

<figure><img src="/files/6Ej2brAUKpEDR6TS0psq" alt=""><figcaption></figcaption></figure>

The ‘Analyze’ tool lets you see further website and infrastructure analysis including domain status, DNS records, and registration metadata:

<figure><img src="/files/8TnXzOtD6OWH7hBb4PXh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/z3L4vJZsvr8GsW7n6z4p" alt=""><figcaption></figcaption></figure>

**2. Assess risk level by checking whether suspicious variants could be used for phishing, fraud, or impersonation.**

### Cost

* [x] Free
* [ ] Partially Free
* [ ] Paid

## Data Processing

### Account Required:

* [ ] Yes
* [x] No

### Cookies:&#x20;

Cookies mainly support user authentication, session management, and analytics tracking for the site. They include login/session tokens (Clerk), customer support and chat tracking (Intercom), and usage analytics (PostHog).

### Use in Reporting

Have I been Squatted is useful for:

* Identifying phishing infrastructure.
* Checking impersonation risk of brands or organisations.
* Supporting cybercrime and fraud investigations.
* Documenting malicious domain registration patterns.

For example, Security teams can proactively check their organisation’s domain to see what attackers might already have registered, helping domain monitoring strategies, defensive domain registration, and alerting incident response teams early.&#x20;

As another example. researchers can aggregate squatting patterns across sectors (finance, shipping, government services) to show which industries are most targeted, how naming tactics evolve over time, and emerging phishing trends.

In practice, the tool isn’t just about spotting “fake domains”, it’s a starting point for mapping threat infrastructure, identifying impersonation risk, and building evidence-based reporting around phishing and fraud ecosystems.

| **Capabilities**                                        | **Limitations**                                                         |
| ------------------------------------------------------- | ----------------------------------------------------------------------- |
| Generates typo-squatted domain variations.              | Doesn’t guarantee malicious intent of a domain.                         |
| Helps identify potential phishing or scam domains.      | May produce false positives (e.g. legitimate parked or unused domains). |
| Quick, lightweight checks for brand impersonation risk. | Limited context beyond domain similarity.                               |
| Useful for early-stage cyber threat detection.          | Not a full threat intelligence platform.                                |
| <p><br></p>                                             | Requires further verification using additional OSINT tools.             |

### Summary

Have I Been Squatted is particularly useful in OSINT workflows when you’re trying to map out threat infrastructure or check whether a brand is being targeted by impersonation.

### Ownership

Have I Been Squatted is owned and operated by a small independent team led by its co-creators [Juxhin Dyrmishi Brigjaj](https://www.linkedin.com/in/juxhin-db/) and [Ian Muscat](https://www.linkedin.com/in/ianmuscat/), through their company Have I Been Squatted Inc.&#x20;

### Ethical Considerations

* Domains flagged as “suspicious” are not automatically malicious.
* Always verify before attributing intent to domain owners.
* Avoid publishing unverified accusations of fraud.
* Use responsibly in cybersecurity and investigative contexts.
* Respect privacy and avoid targeting non-malicious domain holders.

### Related Tools:

* VirusTotal domain analysis
* [urlscan.io](/osint-tools/urlscan.md)
* SecurityTrails

#### Sources

<https://haveibeensquatted.com/>&#x20;

<https://haveibeensquatted.com/about/terms>&#x20;

<https://www.linkedin.com/in/juxhin-db/>&#x20;

<https://www.linkedin.com/in/ianmuscat/>