What is combosquatting? Examples from 5,600 domains

What combosquatting is

Combosquatting is registering a domain that contains a brand name spelled correctly, combined with another word: paypal-support[.]com, secureyourbank[.]com, myappleid-help[.]com. Nothing is misspelled, so the reader's spelling check passes. The added word does the persuading by hinting at a login page, a help desk, a refund or a delivery.

A 2017 study by Kintis and colleagues ("Hiding in Plain Sight", ACM CCS) counted about 2.7 million combosquatting domains in six years of DNS data, far more than typosquats, and found many of them stayed up for years. Greyphish's counts for public brands come out the other way: of 19,081 lookalikes first seen in the 90 days to 1 October 2026, 5,611 (29%) were combosquats and 12,235 (64%) typosquats. The difference is age. Most of those typosquats are years-old domains renewing certificates, while combosquats are new when they appear (see below).

Counts use whole-word brand matches; an earlier version counted brand names inside other words.

The trade-off for the attacker is that a combo is easier to spot once you know to look. That is why monitoring for them works, and why they are often the quickest lookalikes to get suspended.

The shapes a combosquat takes

Greyphish classifies each combo it detects by where the extra text sits:

Hyphenated combos are often long. In a burst of certificates for unregistered .ph names over the summer, Greyphish logged names like facebook-password-reset-token-check-media-login[.]ph, five or six words chained together. Length looks clumsy written down, but on a phone the address bar shows only the start, and the start is the brand.

The words attackers add

Greyphish flags a combo only when the brand appears next to a word from a list of about forty that are associated with impersonation, so the table below ranks those words against each other rather than discovering new ones. Even so, the ranking is informative: it shows which framings registrants actually choose.

They group into a few stories:

• Your account: my, account, portal, app. They copy the shape of real customer portals, which is why my tops the list.
• The help desk: support, help, center, service. Used for fake support numbers and remote-access scams as much as for credential pages.
• The security prompt: secure, login, verify, auth, update, alert. The classic credential-phishing vocabulary.
• Money: wallet, plus billing, claim, invoice and refund just below the cut.

Combosquats are new when they show up

When a lookalike first appears in a Certificate Transparency log, Greyphish compares that moment with the domain's WHOIS creation date. For typosquats the gap is usually years. For combosquats it is days:

The median combosquat was two days old. In practice, the certificate is issued as part of setting the domain up, so a CT log sighting is close to the registration itself. A tool that only checks once a month sees most combos weeks after they were put to use.

Real examples from the last week of September

These combosquats were first seen between 25 and 27 September 2026 and, when checked, were registered, serving a website and publishing mail records. That is all the list says. We make no claim about who registered them or why.

Matching still needs judgment. Until October 2026 Greyphish matched brand names inside other words, so real-estate-franchise-opportunity[.]ca counted as Unity because "opportunity" ends in "unity", and thespiritweb[.]com as an airline called Spirit. Brands that are ordinary words generate this kind of noise constantly. Greyphish now treats a keyword as a combo only when the brand word is five or more characters, stands as a whole word, and appears with a modifier associated with impersonation, and it still shows the evidence so a person makes the call.

How to watch for combosquats of your name

For registered ones, run dnstwist with a dictionary of likely words:

printf "my\napp\nsupport\nhelp\nsecure\nlogin\nverify\naccount\nportal\nbilling\n" > words.txt
dnstwist --registered --dictionary words.txt --format csv yourcompany.com

That only finds combinations you thought of. To catch the rest, search Certificate Transparency for your name anywhere in a hostname. crt.sh accepts % as a wildcard (written %25 in a URL):

curl -s "https://crt.sh/?q=%25yourcompany%25&output=json" | jq -r '.[].name_value' | sort -u

Broad patterns often time out on crt.sh, and the results include your own hosts, so this works best for a distinctive name. For anything ongoing you want a live feed matched as certificates arrive; the CT monitoring guide covers the options.

Greyphish does that matching for you: it checks every new certificate and zone-file registration for your name with the modifiers above, attaches DNS, MX, live-site and registrar evidence, and emails a daily digest. Watching one domain is free.

What to do when you find one

Combos are the easiest lookalikes to act on, because a domain that pairs your trademark with "login" or "support" and hosts a copy of your page is hard to explain innocently. Gather evidence, then report to the registrar and the hosting provider, and submit the URL to Google Safe Browsing and Netcraft. The takedown guide walks through it, including when URS or UDRP is worth paying for.

If the domain has mail records, warn the people most likely to receive mail from it, usually support and finance. The MX records guide explains what to check.

Questions