Menu

Lookalike

Combo Squatting

Combo Squatting: Fake Domains That Add Words to Your Brand Name

< BLOG

Combo Squatting: Fake Domains That Add Words to Your Brand Name

Combo Squatting is when a criminal keeps your brand name correctly spelled but adds an extra word to make a fake domain appear official. For example, yourbrand-support.com, yourbrand-login.com, or secure-yourbrand.com may look like genuine customer-service, account, or security pages. Unlike typosquatting, there is no obvious spelling mistake—the attacker relies on the familiar brand name plus a believable word to persuade someone to click, sign in, make a payment, or share information. Common additions include “support”, “login”, “help”, “secure”, “account”, “verify”, and “service”.

Your business name is correct. The website is not.

A customer receives a message from support@yourbrand-help.com. They see your business name, the word “help”, and a professional-looking email. Nothing immediately looks wrong.

That is what makes Combo Squatting effective.

The attacker is not relying on a customer typing the wrong letter. They use your name exactly as it is known, then add a word that makes the domain appear useful, official, or urgent. The added word gives the false address a purpose: support, billing, login, security, delivery, careers, payment, or account access.

For an SME, this can be especially damaging because customers may already know your business by name and expect direct contact from a small team. A realistic-looking support or accounts address can be enough to start a conversation, request a payment, or send someone to a fake page.

That is why The TLD Project monitors more than exact matches. The greatest impersonation risk is often not a misspelling of your name, but your real name combined with the right word.

Combo Squatting

Combo Squatting is a form of domain squatting in which a recognisable brand name is combined with another word, phrase, number, or location. The brand name remains intact; the attacker adds something around it.

Examples:

  • yourbrand-support.com
  • yourbrand-login.com
  • yourbrand-billing.com
  • yourbrand-payments.com
  • yourbrand-secure.com
  • yourbrand-orders.com
  • yourbrand-uk.com
  • shop-yourbrand.com

The word can be placed before or after the brand, joined with a hyphen, written together, or combined with a different domain extension.

The words attackers choose

The added word is rarely random. It is selected to match a moment when someone may be ready to act without thinking for long.

A customer who has an order problem expects to see “support”, “delivery”, “tracking”, “returns”, or “help”. Someone who receives an account-security message may expect “secure”, “verify”, “login”, “alert”, or “account”. A supplier receiving an invoice may see “accounts”, “billing”, “payments”, or “finance” and assume it is part of your normal process.

Common Combo Squatting keyword groups include:

  • Customer service: support, help, service, contact, returns, delivery, tracking.
  • Account access: login, sign-in, account, portal, verify, reset, secure.
  • Money and billing: payments, billing, invoice, refund, accounts, finance.
  • Trust and urgency: secure, alert, confirm, protect, update, renewal.
  • Location and business identity: country codes, city names, group, team, online, official.

The word does not need to prove the connection. It only needs to make the connection feel plausible.

How the scam unfolds

Combo Squatting can be used to make an email sender address, website link, QR code, or social-media advert look like part of your business.

For example, a customer might receive an email telling them that a delivery has failed. The link points to yourbrand-delivery.com. The page copies your logo and asks them to pay a small redelivery fee. The fee is not the real objective; the attacker may be collecting card details for later fraud.

A supplier might receive a message from accounts@yourbrand-payments.com stating that your bank details have changed. Because the domain contains your exact business name and a sensible accounts-related word, the request can look more credible than an obvious misspelling.

Combo-squatted domains are widely used in phishing, scam websites, and social-engineering campaigns because they combine a trusted name with a context-specific keyword.

What to monitor

A useful Combo Squatting watchlist is not a random list of words. It should reflect the ways people interact with your business.

If you sell products online, monitor combinations related to orders, delivery, refunds, returns, store, shop, and customer support. If you invoice clients, prioritise accounts, billing, payment, finance, invoice, and bank. If your business has a client portal or staff login, watch for login, account, secure, verify, access, and portal.

Start with the following high-risk words:

  • Support
  • Help
  • Login
  • Account
  • Secure
  • Verify
  • Payment
  • Billing
  • Invoice
  • Refund
  • Service
  • Delivery
  • Orders
  • Shop
  • Official

Then add words that are unique to your business: product names, departments, locations, service names, trading names, and commonly used customer language.

A Combo Squatting domain is not automatically fraudulent. It could belong to a legitimate reseller, partner, unrelated company, or business with a similar name. The risk becomes clearer when the domain copies your branding, claims to represent you, sends deceptive messages, collects information, or attempts to take payment.

The TLD Project helps SMEs monitor their brand name combined with high-risk keywords across TLDs, identify likely impersonation domains, and take evidence-led professional action.

Combo Squatting
The TLD Project: Empowering everyone to take professional action.

What are lookalike domains

What are lookalike domains? How criminals copy your web address

< BLOG

Lookalike Domains: How Attackers Mimic Trusted Business Websites

Lookalike domains are no longer a problem isolated to established brands. Attackers use AI and fraudulent tactics to target all sizes of business. 

It is close enough to fool someone. That is all the attacker needs.

Many business owners assume criminals only go after banks, global retailers, and large enterprise brands. That is not how most impersonation works. Attackers look for businesses that people trust. That could be a local contractor, manufacturer, agency, accountancy firm, online shop, software company, wholesaler, legal practice, training provider, or any business that sends invoices and receives payments.

If someone knows your business name, expects an email from you, pays you online, logs into your platform, or buys products through your website, they can be targeted through a fake version of your web address.

A criminal does not need to break into your website. They can register a different domain that looks close enough to yours and use it to pretend they are you. That is why we built The TLD Project: to give SMEs a practical way to identify suspicious, lookalike domains, gather evidence, and take professional action.

Lookalike Domains

A lookalike domain is a domain name deliberately designed to look connected to a real company, brand, product, or service.

Your genuine domain might be:

  • yourcompany.co.uk

A criminal may register:

  • yourcompany.co
  • yourcompany-group.com
  • yourcompany-support.com
  • yourcompnay.co.uk
  • your-company.co.uk
  • yourcompany.services

Each address is different. Yet each may look believable enough to a customer, supplier, or employee who sees it quickly in an email, text message, Google result, invoice, or social-media advert.

Lookalike domain is the broad term. The specific technique may be:

  • Typosquatting — exploiting a typing error, such as swapped or missing letters.
  • Combo squatting — adding words such as “secure”, “login”, “billing”, “support”, or “payments” to your business name.
  • TLD impersonation — using the same name with another domain ending, such as moving from .co.uk to .com, .co, .shop, or .site.
  • Homoglyph or IDN homograph attacks — replacing letters with characters that look identical or nearly identical.

The technique may differ, but the purpose is the same: to borrow the trust your business has already earned.

How an SME can be targeted

A criminal may copy your website branding, use a close version of your address, and send emails that look as though they came from your business. Lookalike domains can be established quickly and with little expense.

For example, a supplier receives an email from:

accounts@yourcompany-support.com

The email claims that your bank details have changed and asks the supplier to update their records. The supplier recognises your company name, sees what looks like a plausible address, and sends the next payment to a criminal account.

Or a customer receives an email saying there is a problem with an order. The link takes them to yourcompany-orders.com, where they are asked to sign in or enter card details. The website may look convincing because the attacker has copied your logo, product images, and wording.

The business being impersonated may only find out after a customer complains, a supplier calls to verify a payment request, or a fraud victim leaves a negative review.

Phishing commonly relies on fraudulent messages and copycat websites to persuade people to disclose sensitive information or transfer money. ICANN categorises phishing as DNS Abuse.

Why it matters

For an SME, one impersonation incident can be disproportionately disruptive.

You may not have a large security team, a dedicated brand-protection provider, or time to deal with registrars, hosting companies, email evidence, and takedown reports while running the business.

The consequences may include:

  • Customers losing money or giving passwords and card details to criminals.
  • Invoices paid to the wrong bank account.
  • Staff credentials stolen through a fake Microsoft 365, Google Workspace, or payroll login page.
  • Time spent handling calls, complaints, evidence, and reports.
  • Damage to a reputation built over years.
  • Lost customer confidence, even after the fake domain is removed.

Fraudulent lookalike domains do not need to be fully active to create risk. It may redirect somewhere else, support email-only fraud, display a holding page, or wait until an attacker launches a phishing campaign.

What to do next

If you find a suspicious domain using your business name, do not assume it is harmless because the website is blank or poorly built.

Record the domain name, registration details where available, screenshots, copied content, redirects, and any messages sent from it. If the domain has appeared in an email, save the original email and its full headers.

Do not enter login details, card information, or personal data into the site to test it. Assess whether the domain is being used for a website, email, redirects, phishing, or another impersonation method.

Authorities advise organisations facing brand impersonation to identify the registrar and hosting provider, then submit an evidence-based takedown report.

The TLD Project helps SMEs monitor domain variations across TLDs, identify potential impersonation threats, collect clear evidence, and take professional action without needing an enterprise security team.

Lookalike Domains
The TLD Project: Empowering everyone to take professional action.