Have I Been Squatted

Have I Been Squatted finds attacker infrastructure while it is being set up. Lookalike domains, mail servers, staging hosts and their certificates often appear before a phishing campaign launches. This plugin brings detection, investigation and response for them into ChatGPT and Codex. Enrich and hunt, for any domain - Analyze: live DNS, mail, registration, hosting, HTTP and classification for one domain, with a verdict profile and an interactive view with a screenshot and hosting map. Fast depth takes under a minute; slow depth renders the page and reports what it asks visitors for, such as passwords, one-time codes or payment data. - Certificate transparency search: find certificate names matching a pattern, such as lookalike spellings of your brand, with the last time each was seen. Answers immediately. - Typosquat scan: generate permutations of a domain and check which are registered or live, ranked by evidence. Typically 5 to 10 minutes. - Discover: find unregistered lookalikes of a domain that could still be registered defensively. Work your organization's detections - Query: search lookalikes found for your monitored domains, and Email Intelligence and Site Canary events, from the last 30 days. The model reads the field catalog before writing a query, so you can ask in plain language. - Alerts: review the alerts your detection rules raised, the evidence each cites and whether each response reached its destination, then resolve, ignore or mark them false positive. - Results: tag a result as owned, ignored, false positive or malicious; the tag carries over to later results for the same domain. Add a domain you analyzed to a monitored domain's results. - Rules: list, validate, create, update, enable, disable and delete detection rules and the responses they trigger in your connected tools. - Responses: send one result to a connected tool now, outside any rule, such as a SIEM finding, a Slack message or a block in Microsoft Defender or Cloudflare Gateway, and check that it was delivered. - Monitored domains: list, add, tune and remove the domains you monitor. - Takedowns: open a managed takedown case for a malicious domain, follow its timeline, add updates and link related alerts. Background jobs Scans and deeper analyses take longer than a single reply. They start a background job and return straight away; ask for the status later in the conversation to get ranked results. Jobs expire after 24 hours, and each organization runs three at a time. Changes Tools that change your organization's data need an organization admin, and ChatGPT asks you to confirm each one. Takedown cases are reviewed by the Have I Been Squatted operations team before any report reaches a registrar or host. Sending a response changes your own security tools; the monitored domain itself is never blocked. Removing a monitored domain or deleting a rule cannot be undone. Example prompts - "Show this week's lookalike detections for my organization and group them by monitored domain." - "Which alerts are still active, and did their Splunk responses get delivered?" - "Analyze secure-examp1e-login.com and tell me whether it is live and what it is hosting." - "Create a rule that alerts on lookalikes of example.com within one character that ask visitors for a password." Access requirements - Requires a Have I Been Squatted account. You sign in with OAuth and choose which organization to connect; every call is scoped to that organization and to your role in it. - Lookups work for every account. Organization tools need domain monitoring, and querying detections needs at least one monitored domain with a completed scan. - Email Intelligence, Site Canary and Takedowns tools work when those features are enabled for your organization; the plugin lists only the tools your organization can use.