Combosquatting

Typosquatting waits for someone to mistype your name. Combosquatting doesn't wait: it keeps your name spelled correctly and adds a word, so the address reads like part of your business. Someone who sees example-support.com in an email has no typo to notice.

That makes combosquats a phishing tool more than a traffic trap. Researchers who studied six years of DNS data found them used for phishing, social engineering, affiliate fraud and trademark abuse, and saw their use grow year on year.

Every one of them names something a customer expects to do on your site: get help, sign in, pay, check an account. TypoScan tries your name with each of these, after it and in front of it, with and without a hyphen.

Squatters rarely stop at your own ending. In a 2025 study of 2.3 million lookalikes of the most visited sites, brand-plus-word names on the original ending were 15% of the total, and on a different ending another 27%. Cheap endings like .xyz and .top are popular because they cost little and few people recognise them as unusual.

Akamai's authors also point out that typosquatting gets most of the attention, even though the 2017 study they cite found combosquatting domains about 100 times more prevalent.

There are far too many combinations to register them all. Register the few that sit closest to what customers really do with you, usually -login, -support and -pay on your own ending, and point them at your site.

For the rest, watch for new registrations, and pay most attention to the ones with mail servers: those can send and receive email that looks like it's from you. When one hosts a phishing page, report it to the registrar and the hosting provider; their abuse contacts are in the domain's Whois record.