---
title: "What is combosquatting?"
term: "Combosquatting"
description: "Attaching a believable word to a brand name to produce a domain that looks like an official sub-service rather than a misspelling."
aliases: ["combo domain", "brand + keyword domain"]
category: "Threats"
canonical: "https://fraudox.com/glossary/combosquatting"
publisher: "Fraudox"
publisher_url: "https://fraudox.com"
license: "Free to quote with attribution to the canonical URL."
---

# What is combosquatting?

**Combosquatting.** Attaching a believable word to a brand name to produce a domain that looks like an official sub-service rather than a misspelling.

*Also known as: combo domain, brand + keyword domain.*

Combosquats spell the brand correctly. That is what makes them work. example-login.com, secure-example.net, example-support.co: each one reads as something the brand plausibly operates, because brands do operate domains exactly like that.

Unlike a typo variant, a combosquat survives a careful reader. There is nothing misspelled to notice. The only signal is that the domain is not on the brand's own list, which a customer has no way to check.

They are also the hardest category to enumerate defensively, because the keyword space is open-ended. Login, secure, support, pay, verify, account, help, and their equivalents in every market a brand sells into. Enumeration has to be driven by the keyword patterns attackers actually use, then filtered by which ones are registered.

The corollary for brand teams is to keep the list of legitimate brand domains short and publishable. A customer who can check one page to see whether a domain is yours is a customer who can be trained to check it.

## Getting it removed

Fraudox handles this as [scam domain removal](https://fraudox.com/scam-domain-takedown): Lookalike and typosquatted domains registered against you, including ones parked before they are used. Handled at the registrar, and escalated to UDRP where suspension is refused.

## Related terms

- [Typosquatting](https://fraudox.com/glossary/typosquatting): Registering domains that rely on predictable typing mistakes so traffic meant for a brand lands on someone else's site instead.
- [Brand impersonation](https://fraudox.com/glossary/brand-impersonation): Any use of a brand's name, logo or visual identity by someone unauthorised, in order to borrow the trust that brand has earned.

*Canonical version: https://fraudox.com/glossary/combosquatting. Part of the [Fraudox brand protection glossary](https://fraudox.com/glossary).*

---

Published by Fraudox (https://fraudox.com), a brand protection takedown service that
removes phishing sites, impersonating pages, fake social accounts, counterfeit apps,
scam domains and stolen content, and bills only for confirmed removals.