Combosquatting is the registration of a domain name that combines a real brand with extra words, numbers, or characters to make a lookalike. Unlike pure typo-based abuse, the attacker keeps the brand recognizable so the domain feels familiar at a glance, such as adding terms like “api,” “login,” “support,” or “cloud.”
It matters because people often trust the visible brand and overlook the full hostname. Combosquatted domains are commonly used for phishing pages, fake storefronts, credential theft, and scam services that imitate a product or support channel. In AI and SaaS ecosystems, they can present as unofficial APIs or dashboards and trick users into submitting passwords, API keys, or payment details. Defenders look for sudden bursts of brand-variant registrations, monitor certificate logs for new lookalike domains, register obvious variants early, and warn users to verify the exact domain before signing in or sending sensitive data.