Combosquats spell the brand correctly. That is what makes them work. example-login.com, secure-example.net, example-support.co: each one reads as something the brand plausibly operates, because brands do operate domains exactly like that.
Unlike a typo variant, a combosquat survives a careful reader. There is nothing misspelled to notice. The only signal is that the domain is not on the brand's own list, which a customer has no way to check.
They are also the hardest category to enumerate defensively, because the keyword space is open-ended. Login, secure, support, pay, verify, account, help, and their equivalents in every market a brand sells into. Enumeration has to be driven by the keyword patterns attackers actually use, then filtered by which ones are registered.
The corollary for brand teams is to keep the list of legitimate brand domains short and publishable. A customer who can check one page to see whether a domain is yours is a customer who can be trained to check it.
How Fraudox handles it
Scam domain takedown