Combosquatting is the brand name plus an extra word: acmebank-support.com, acmebank-login.net, secure-acmebank.com. The brand is spelled correctly, which is exactly what makes it hard.
Why it defeats the defences that work on typos
| Typosquatting | Combosquatting | |
|---|---|---|
| Space to defend | Finite. A brand has a countable set of plausible misspellings. | Unbounded. Any word, any separator, any order, any TLD. |
| Detection by string distance | Works — a typo is one or two edits away. | Fails — the brand is spelled correctly and the extra word makes the string distance large. |
| Defensive registration | Viable for the top variants. | Not viable. You cannot register the combinations. |
| Plausibility to a reader | Looks wrong if noticed. | Looks right. Organisations genuinely do register names like this. |
The uncomfortable part
Many organisations legitimately use exactly this pattern — brand-careers.com, brand-status.com, brandpay.com — often registered by a marketing team without telling anyone. So your own estate has trained your customers to accept the shape that the attack uses, and your own staff often cannot say with certainty whether a given name is yours.
The words that recur
Attacker word choice is not arbitrary: it is chosen to justify the action the message is asking for. Monitoring is much more tractable if you weight these rather than watching every possible combination.
- Access: login, signin, account, portal, verify, auth, sso, mfa
- Trust: secure, safe, official, verified, protect
- Money: pay, payment, billing, invoice, refund, wallet
- Help: support, help, service, care, desk
- Urgency: alert, notice, update, recovery, unlock
A domain combining your brand with one of these, registered recently, is worth looking at immediately. A domain combining your brand with an unrelated word usually is not.
Start by knowing your own
You cannot triage combosquats without a definitive list of the domains your organisation owns, and almost nobody has one at the start. Build it before you build monitoring — otherwise every alert requires an internal investigation to answer "is this ours?", and the monitoring is abandoned within a month.
# a starting point: everything registered to your billing contacts # - registrar account exports, all registrars # - expense records for domain registrations # - certificate transparency for names you did not know about # - the marketing team, who will remember three you did not find
Defensive registration, honestly
The instinct is to register the variants. It is worth doing for a small, specific set and it is not a strategy:
- Worth registering: the two or three most plausible typos of your primary domain, and your brand in the TLDs your customers would expect. A handful of names, renewed indefinitely.
- Not worth registering: the combosquat space. Every word in the lists above, times every separator, times every TLD, is thousands of registrations a year to pre-empt one attack that will simply use the next combination.
And a defensive registration is not inert. It needs DNS records that say it sends no mail, it needs its own renewals, and a defensive domain that lapses is worse than never having registered it — it now carries whatever reputation your use of it created. The records for a parked domain are:
parked.example. TXT "v=spf1 -all" _dmarc.parked.example. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com" *._domainkey.parked.example. TXT "v=DKIM1; p=" ; and no MX record at all