Is combosquatting the same as typosquatting?

It is a lookalike pattern that contains no typo. The brand is intact and a word is added. Most checkers, including this one, generate both kinds, and the research treats them as related but distinct.

Which words does the generator add?

The words a customer expects beside a brand: login, secure, support, account, billing, help, my, and others, before and after the name, with and without a hyphen, and under other endings.

Why do these domains live so long?

Because nobody stumbles on them; they are used deliberately in campaigns and kept as infrastructure. The 2017 study found almost 60 percent of abusive ones live over 1,000 days.

Can I register every keyword combination?

No; there are hundreds per brand and the list grows with each ending. Watch them, and act on the ones that turn active.

PATTERNS

Combosquatting: Your Brand Plus a Keyword

The brand is spelled correctly. That is the point: nothing about the name looks like a mistake, so nobody looks twice. Illustrative lookalikes in this guide use the reserved .test ending, so that no real registration is named.

by Typosquatting.ai Research23 September 20264 min read

Combosquatting registers a domain that contains a real brand name unchanged, joined to one or more other words, so that example-login.test, secure-example.test and my-example.test all trade on example.test.

This guide covers the keyword families a generator produces, the research that measured how long combosquatting domains survive, why the pattern beats character-level typos at phishing, how the checker ranks these names, and what to do with one.

Family in a report: Keyword compound
Sample: login-example.test
Candidates for a six-letter domain: 1,874 of 3,001 across the five keyword families

What combosquatting is

The brand appears intact and a word is attached to it: a hyphenated suffix or prefix, a plain compound, or a word plus a different ending. The words are the ones a customer expects to see beside a brand, login, secure, support, account, billing, help, my, and the generator carries a list of them in several positions.

Five of the generator's families are combosquatting, and together they are the largest part of a check: keyword and different ending, 663 candidates for a six-letter domain; keyword compound, 544; keyword with a typo, 384, which combines a keyword with one character-level error; dictionary keyword, 276; and prefixed word, 7.

Family	Example	Candidates for a six-letter label
Keyword and different ending	example-login.app	663
Keyword compound	login-example.test	544
Keyword with a typo	exmaple-login.test	384
Dictionary keyword	example-login.test	276
Prefixed word	my-example.test	7

What the research measured

Kintis and colleagues studied combosquatting at internet scale for their 2017 paper Hiding in Plain Sight, analysing more than 468 billion DNS records collected over almost six years. Their central finding on persistence was that almost 60 percent of abusive combosquatting domains live for more than 1,000 days, which is a different lifetime from a typo domain that is registered, used and dropped. A combosquatting name is a piece of infrastructure.

Unit 42's 2020 study of cybersquatting gave the pattern faces: secure-wellsfargo[.]org, a combosquatting domain that targeted Wells Fargo's customers, and amazon-india[.]online, set up to steal credentials from mobile users in India.

Why it works better than a typo

A typo domain relies on the visitor making a mistake. A combosquatting domain relies on the visitor believing a sentence: that the brand has a login site, a support portal, a billing page, at an address that says so. Nothing is misspelled, the brand is where the eye expects it, and the added word is exactly the word the visitor was looking for. That is why these names are sent, in email and messages, rather than waited for.

How the checker finds and ranks it

A finding's review priority is a published rule, not a score. A name with an address or a mail record is active; active names registered under 90 days ago are Elevated, and so are active names under a year old that carry an impersonation keyword. Anything else that is active or has a registry record is Review, a name with no registry record and no DNS answer is Low signal, and a lookup the registry refused stays Unknown rather than being counted as a negative.

The keyword rule matters here: an active name carrying an impersonation keyword is Elevated for its first year, not only its first 90 days, because a keyword name that has been kept alive is the profile the research describes. Distance bands are wide for this family, since the added word adds many characters, so a report sorted by closeness will put character-level names first; sort by priority to see the keyword names together.

What to do with one

A keyword name that shares your registrar and nameservers is tagged Possibly yours and is usually your own. An active keyword name that is not yours, with mail routing and a recent certificate, is the row that justifies a report to the registrar today rather than a watch. The response guide has the order: registrar abuse, then host, then a dispute where the record supports it. Keep the report; never open the name.

Common questions

Is combosquatting the same as typosquatting?: It is a lookalike pattern that contains no typo. The brand is intact and a word is added. Most checkers, including this one, generate both kinds, and the research treats them as related but distinct.
Which words does the generator add?: The words a customer expects beside a brand: login, secure, support, account, billing, help, my, and others, before and after the name, with and without a hyphen, and under other endings.
Why do these domains live so long?: Because nobody stumbles on them; they are used deliberately in campaigns and kept as infrastructure. The 2017 study found almost 60 percent of abusive ones live over 1,000 days.
Can I register every keyword combination?: No; there are hundreds per brand and the list grows with each ending. Watch them, and act on the ones that turn active.