Combosquatting

How combosquatting works

Combosquatting is not a typo in the narrow sense, it is a deliberate naming trick. The attacker keeps a real brand intact and adds a plausible word such as “login”, “secure”, “support”, or “update” so the address looks service-like at a glance. That makes it useful for phishing, fake portals, and other trust abuse where hurried users rely on pattern recognition more than close inspection.

Why combosquatting is persuasive

The technique works because many users recognise the brand before they notice the extra word or the full registrable domain. A name like brand-login-example.com can feel more legitimate than a random string, especially in email, SMS, social media, or search results where attention is fragmented. The added term often mirrors real user intent, which helps the domain blend into common service journeys.

Combosquatting is especially effective when the attacker borrows vocabulary that matches routine account activity, such as billing, verification, password reset, or security notices. That semantic fit lowers suspicion without needing to mimic the exact official domain.

Where combosquatting fits in the domain-abuse landscape

Combosquatting sits alongside typosquatting, homograph abuse, cousin domains, and other lookalike-domain techniques, but the mechanism is different. Typosquatting depends on misspellings or keystroke errors; combosquatting depends on added terms that feel operationally relevant. Because the base brand is real, the domain can survive a quick visual check unless the user inspects the full string and registrant context.

Defenders should treat combosquatting as part of broader brand impersonation risk, not as a niche naming issue. A convincing-looking domain can be used to collect credentials, route users to malware, stage social-engineering lures, or support fraudulent customer-service workflows.

How organisations detect and reduce exposure

Exposure is usually found through domain monitoring, certificate transparency review, search and email abuse reporting, and searches for brand-plus-generic-term patterns. Security teams also need to consider whether the lookalike domain is being used in messaging, QR codes, advertising, or redirected landing pages, because combosquatting often becomes dangerous through the delivery channel rather than the domain alone.

For a broader defensive playbook on lookalike domains, CT log monitoring, defensive registration, and takedown options, see Typosquatting and Lookalike Domains Guide. Organisations should also align this work with mailbox, browser, and web-filtering controls so that domain reputation signals are not the only line of defence.

Risk and Threat Considerations

Combosquatting is risky because it exploits familiar brand language to create a false sense of legitimacy. The main threat is not only user confusion, but also the downstream abuse that follows when users submit secrets, approve actions, or install untrusted software from a site that appears routine.

Failure mechanism: The attacker registers a domain that preserves the brand while adding a service-like word, then uses that semantic cue to pass quick human screening and deliver phishing, credential capture, or malware.

Impact: Organisations can lose credentials, sessions, and customer trust, and may also face account takeover, fraud, incident response burden, and brand-reputation damage.

Practitioner Guidance

Why practitioners should care: Combosquatting often succeeds without technical exploits, which makes it easy to underestimate. Treat it as a brand-and-access problem as much as a DNS problem, because the real damage usually appears when users are pushed into handing over authentication material or authorising a fake workflow.

What to watch for: Look for domains that pair a protected brand with generic service words, especially when they appear in login, support, reset, verification, or invoice contexts. Prioritise cases where the domain is newly registered, delivered through email or messaging, or used to imitate a high-frequency business process.