Combosquatting is a domain impersonation technique where an attacker registers a domain that pairs a real brand name, spelled correctly, with an extra word, phrase, or hyphen, such as [brand]-login.com or secure[brand].net. Typosquatting relies on misspellings. Combosquatting relies on the brand looking exactly right, so the domain reads as an official support portal, billing page, or promotion rather than a mistake.
Attackers use combosquatted domains for phishing, credential theft, fake customer support, invoice fraud, and malware delivery. Every one of those depends on your brand's credibility, which makes combosquatting a brand-protection problem as much as a security one.
How Combosquatting Differs From Typosquatting
Both attacks exploit trust in a familiar name, but they target different human weaknesses.
- Typosquatting bets on a slip of the finger or eye: a swapped letter, a missing character, or a homoglyph (a lookalike character, sometimes from another alphabet via internationalized domain names).
- Combosquatting bets on plausibility. The brand is spelled perfectly, and the added word makes the domain feel purpose-built.
That difference matters for detection. Spell-check instincts and "look closely at the URL" training catch typos. They don't catch a correctly spelled brand followed by "-support." Most people have learned that companies run many legitimate domains and subdomains, so an extra word rarely raises suspicion.
Common Combosquatting Patterns
Attackers choose added words that match the action they want the victim to take. The most common categories are:
- Account and security words: login, signin, verify, secure, account, auth, password, reset
- Support words: help, support, service, care, contact, desk
- Money words: billing, pay, invoice, refund, wallet, checkout
- Promotion words: promo, rewards, gift, deals, offer, giveaway
- Corporate words: hr, careers, portal, team, corp, internal, sso
- Geographic or product words: a country code, city, or real product line name added to the brand
These usually appear in a few structural forms:
- Prefix or suffix with a hyphen: [brand]-billing.com, support-[brand].com
- Concatenated: [brand]login.com, my[brand].net
- TLD variation on top of the combo: the same combination registered across .com, .net, .org, country-code TLDs, and newer generic TLDs
- Subdomain stacking: the brand appears in the leftmost part of a hostname the attacker controls, such as example.com.account-verify.example.net. On mobile browsers that truncate long URLs, the victim may see only the first portion.
How a Combosquatting Attack Works
A combosquatting campaign is cheap to set up. The pieces are standard internet infrastructure.
Registration and concealment
The attacker registers the domain through any registrar, often with WHOIS privacy enabled, so ownership details are hidden. Many domains sit idle for a while ("aged") before use, because some filters treat brand-new domains with more suspicion.
Making it look legitimate
The attacker obtains a free TLS certificate, so the site loads over HTTPS with a padlock. Users have long been told the padlock means "safe," but it only means the connection is encrypted. It says nothing about who runs the site. The attacker then clones your login page,support portal, or checkout flow, often copying your logo, fonts, and footer text directly from your real site.
Weaponizing email
Many combosquatted domains get MX records so they can send and receive email. That lets the attacker send invoices from billing@[brand]-payments.com or password resets from security@[brand]-verify.net. Because the brand is spelled correctly in the sender address, these messages often pass a quick glance from employees, customers, and suppliers. Your own SPF, DKIM, and DMARC records protect only your domains. They do nothing to stop mail sent from a domain the attacker owns.
Driving traffic
Links reach victims through phishing emails, SMS messages, paid search ads, social media posts, and fake support numbers. Once a victim enters credentials or payment details, the attacker harvests them, and the domain is often abandoned before takedown, replaced by the next variant.
Warning Signs of a Combosquatted Domain
Train your team and customers to check for these signals:
- Your brand name followed or preceded by an action word you don't actually use in your domains
- A domain that isn't on your published list of official domains
- Login or payment requests arriving from a domain your organization has never emailed from before
- A recently registered domain with hidden WHOIS ownership that uses your brand
- Urgent language ("verify within 24 hours," "account suspended") paired with an unfamiliar link
- The brand appearing only in a subdomain, with a different registered domain at the end of the hostname
How to Prevent and Respond to Combosquatting
You can't register every possible combination, so the goal is to reduce exposure and catch the rest quickly.
- Register high-risk variants yourself. Secure your brand plus the obvious money and account words (login, pay, billing, support) in your primary TLDs, and redirect them to your real site.
- Publish your official domains. Tell customers and suppliers which domains you use for email, support, and payments, and that you will never ask for credentials elsewhere.
- Enforce DMARC on your own domains. It doesn't stop combosquats, but it removes the easier option of spoofing your exact domain and gives you reporting visibility.
- Monitor continuously. New combosquats appear constantly. Dokyma generates brand-plus-keyword permutations, checks which are registered, inspects their DNS, MX, and WHOIS data, and watches certificate transparency logs for new TLS certificates issued to domains containing your brand. All of this happens in your dokyma.com scan, without manual work on your end.
- Act fast on confirmed threats. Collect evidence (screenshots, headers, the live page), report abuse to the registrar and hosting provider, warn affected customers, and pursue a UDRP complaint for domains that clearly infringe your trademark.
Prioritize domains with active MX records or live login pages. Those are ready to attack, while parked domains are a watch-list item.
Check Which Combosquats Already Target Your Brand
The fastest way to understand your exposure is to see the domains that already exist. Run a free brand scan at dokyma.com. It will show which brand-plus-keyword domains are registered, which can send email, and which have fresh certificates, so you know exactly where to act first.