Combosquatting

Combosquatting is the registration of domains that combine a correctly spelled brand name with an extra word, hyphen or phrase, for example the brand plus login, support, refund or a country name. Unlike typosquatting, nothing is misspelled, so the domain looks like a legitimate service, campaign or regional site. It is one of the most common patterns behind phishing and fake shop domains.

How it works

Because no misspelling is needed, the number of possible combinations is almost unlimited: examplebank-login[.]com, examplebank-secure[.]net, examplebankrewards[.]com, examplebank-support-center[.]com. Attackers pick words that fit the lure: tracking for delivery scams, verify for account alerts, careers for fake recruitment, airdrop for crypto. A related trick puts the brand in a subdomain of an unrelated domain, such as examplebank.secure-verify[.]com, where the real owner is secure-verify. Registration takes minutes, and many of these sites go live soon after the domain is created, which is why newly registered domains deserve close attention.

Example

An illustrative case: a campaign targets customers of a fictional telecom operator with an SMS about a bill refund. The link goes to exampletel-refund[.]com, where the brand name is spelled exactly right. The page copies the operator's design and asks for card details so the customer can "receive" the refund.

How to spot it

• The brand name is spelled correctly but has an added word or hyphen.
• The brand's official domain does not normally use hyphens or that keyword.
• The domain is recently registered, hides its owner and has a newly issued certificate.
• The link appears in an SMS, ad or social post rather than on the brand's own website.
• Reading the domain from the right shows that the real owner is not the brand.

What brands can do

• Monitor registrations and certificate transparency logs for any domain containing your brand name, not just typo variants.
• Keep an internal list of the domains you really use, so staff can verify reports quickly.
• Avoid hyphenated or keyword domains for your own campaigns, or customers will learn to trust that pattern.
• Take down active phishing domains through the registrar and host; for passive domains that infringe your trademark, consider UDRP.

Phishvoid watches for combosquatting domains around your brand and files takedowns once a site is verified as abusive; contact the team to find out more. Further reading: Typosquatting and homoglyph domains explained.

Read more: Typosquatting and Homoglyph Domains Explained