Combosquatting
What is Combosquatting?
Combosquatting in cybersecurity is a form of brand impersonation and domain manipulation where threat actors register domain names that combine a legitimate, correctly spelled corporate trademark or brand name with one or more operational, contextual, or security-related keywords.
Unlike typosquatting, which relies on typographical errors, keyboard proximity slips, or omitted characters (such as exampel.com), combosquatting uses the brand name spelled completely correctly. Adversaries append, prepend, or intersperse familiar operational terms (such as company-login.com, verify-company.net, company-support.org, or company-portal.com) to exploit cognitive biases, implicit trust, and professional context. Because the brand name itself has no spelling mistakes, combosquatted domains look plausible and legitimate to end users, making them effective vehicles for credential harvesting, spear-phishing, Business Email Compromise (BEC), and supply chain fraud.
Technical Mechanics: How Threat Actors Construct Combosquatted Domains
Threat actors systematically construct combosquatted domains by merging corporate brand strings with specific lexical categories designed to induce urgency, compliance, or operational necessity:
Authentication and Access Keywords: Appending terms that mimic single sign-on (SSO) gateways, identity providers, and enterprise entry portals (such as -login, -sso, -auth, -portal, -vpn, or -access).
Security and Verification Keywords: Adding terms designed to simulate corporate IT security teams, compliance notifications, or threat alerts (such as -security, -verify, -validate, -compliance, or -cert).
Administrative and Support Keywords: Prepending or appending terms that suggest internal IT support, corporate help desks, or technical customer care (such as -support, -helpdesk, -admin, -service, or -ticket).
Operational and Financial Keywords: Using terms associated with payroll, accounts payable, partner invoicing, or business workflows (such as -billing, -invoice, -payroll, -hr, -benefits, or -vendor).
Technical Infrastructure Keywords: Appending terms that suggest network components, cloud environments, or software updates (such as -update, -cloud, -app, -mail, -connect, or -api).
Structural Joining Variations: Interspersing keywords with hyphens, underscores, or direct concatenation without separators (such as brand-login.com, brandlogin.com, login-brand.com, or brand-portal-auth.com).
How Adversaries Weaponize Combosquatted Domains
Once registered, combosquatted domains serve as infrastructure across multiple phases of the cyber kill chain:
Credential Harvesting and Reverse Proxies: Attackers configure combosquatted domains with valid SSL/TLS certificates and host clones of enterprise identity portals. Using adversary-in-the-middle (AitM) frameworks, threat actors capture employee usernames, passwords, and multi-factor authentication (MFA) session cookies as users log into what appears to be a legitimate corporate authentication page.
Business Email Compromise (BEC) and Vendor Fraud: Cybercriminals configure authoritative Mail Exchange (MX) records, Sender Policy Framework (SPF), and DomainKeys Identified Mail (DKIM) on a combosquatted domain (such as supplier-invoicing.com). They pose as accounting representatives or corporate executives to instruct employees or partners to redirect payments to fraudulent bank accounts.
Spear-Phishing and Social Engineering: Attackers embed combosquatted URLs in phishing emails, SMS messages (smishing), or collaboration platforms (such as Slack or Microsoft Teams). Because the URL contains the authentic, correctly spelled brand name, recipients are more likely to comply with instructions to reset passwords or download software.
Malware Delivery and Watering Hole Attacks: Adversaries use combosquatted software portals (such as brand-software-update.com) to distribute trojanized applications, backdoors, or infostealers disguised as mandatory corporate software packages.
Consumer Scams and Counterfeit Portals: Threat actors create consumer-facing combosquatted destinations (such as brand-order-tracking.com) to capture payment card details, execute financial theft, or distribute counterfeit merchandise under the visual authority of the enterprise.
Combosquatting vs. Typosquatting vs. Homoglyph Attacks
Understanding the distinctions among domain manipulation techniques highlights why detection requires distinct defensive strategies:
Combosquatting: The core brand or trademark is spelled correctly, but is paired with external keywords, operational prefixes, or contextual suffixes (for example, brand-security.com).
Typosquatting: The domain relies exclusively on human typing errors, omitted characters, transposed letters, or keyboard proximity mistakes (for example, brnad.com or barnd.com).
Homoglyph Attacks (IDN Homograph): The domain replaces standard Latin ASCII characters with visually identical glyphs from non-Latin scripts, such as Cyrillic or Greek (for example, swapping Latin o for Cyrillic о), resolving via Punycode to a different server while appearing visually identical.
Why Combosquatting Evades Traditional Security Defenses
Combosquatting represents a persistent evasion challenge for conventional enterprise perimeters:
Legitimate Brand Strings Bypass Basic Text Filters: Keyword-based filtering mechanisms looking for exact brand names may misinterpret combosquatted domains as authorized regional marketing sites, third-party portals, or developer platforms.
Valid Cryptographic Proof: Threat actors provision free, automated SSL/TLS certificates (such as those from Let's Encrypt or ZeroSSL) for combosquatted domains. Modern web browsers display the trusted padlock icon, neutralizing browser-level security warnings.
Aging and Categorization Tactics: Attackers often register combosquatted domains and let them sit dormant or serve benign filler content for 30 to 90 days. This neutralizes "Newly Registered Domain" (NRD) blocks and allows the domain to acquire positive reputation scores in automated web categorization engines before malicious deployment.
Human Cognitive Vulnerability: While trained employees may catch a subtle misspelling in a typosquatted domain, they frequently accept a combosquatted domain (such as portal-company.com) as a legitimate internal system or vendor tool.
Enterprise Defensive Strategies Against Combosquatting
Securing the enterprise against combosquatting requires proactive exposure management, external attack surface monitoring, and automated perimeter blocking:
Algorithmic Combosquatting Enumeration: Deploy external reconnaissance tools that combine corporate trademarks with comprehensive dictionaries of operational, financial, authentication, and IT support keywords across global domain registries to identify suspicious domains upon registration.
Pre-Weaponization Mail Record Inspection: Continuously monitor registered combosquatted domains for the configuration of active MX records, SPF records, or DKIM selectors. Detecting email delivery infrastructure on an unauthorized combosquatted domain provides an early warning signal of impending BEC or phishing campaigns.
Defensive Domain Registrations: Proactively identify and purchase the highest-probability combosquatted variations of core corporate brands (such as primary SSO, portal, and support combinations), setting them to automatically redirect to authoritative corporate destinations.
Protective DNS and Web Gateway Ingestion: Feed verified combosquatted domains directly into corporate protective DNS firewalls, Secure Web Gateways (SWGs), and Secure Email Gateways (SEGs) to block outbound resolution and quarantine inbound deceptive messages before employees interact with them.
Forensic Evidence Collection for Rapid Takedowns: Compile automated evidence dossiers—including registrar records, DNS resolution histories, HTTP response headers, and trademark documentation—to submit abuse complaints to domain registrars and initiate Uniform Domain-Name Dispute-Resolution Policy (UDRP) proceedings.
Frequently Asked Questions
Why is combosquatting often more dangerous than typosquatting?
Combosquatting is often more dangerous because the brand name is spelled completely correctly. Users rarely inspect the full domain structure when they see their company's exact name paired with words like "login" or "support," leading to significantly higher click-through and credential submission rates compared to obvious misspellings.
Can an attacker send emails from a combosquatted domain that pass authentication checks?
Yes. Because the threat actor owns and controls the combosquatted domain, they can configure valid SPF, DKIM, and DMARC records for that specific domain. When an email arrives from ceo@company-portal.com, receiving email servers confirm that the message is authenticated for that domain, allowing it to bypass basic spoofing checks unless advanced display name or domain similarity filters are enforced.
How do organizations identify combosquatted domains before attacks occur?
Organizations track combosquatting through continuous external attack surface management (EASM) and digital risk protection (DRP) solutions that monitor domain registrar feeds and certificate transparency logs in real time, detecting when an unauthorized entity registers a domain containing the brand name alongside operational keywords.
Operationalizing Combosquatting Defense with ThreatNG
Combosquatting in cybersecurity is a form of brand impersonation and domain manipulation where threat actors register domain names that combine a legitimate, correctly spelled corporate trademark with operational, contextual, or security-related keywords. Unlike typosquatting, which relies on typing slips or omitted characters, combosquatting exploits cognitive trust and professional context by appending or prepending familiar terms (such as -login, -portal, -support, -verify, or -sso) to create convincing web addresses. Threat actors use these domains to launch credential harvesting, Business Email Compromise (BEC), spear-phishing, and supply chain fraud.
Traditional security monitoring suffers from the Contextual Certainty Deficit because defensive tooling operates from the inside out. Internal security controls—such as Secure Email Gateways (SEGs), endpoint web filters, and firewalls—inspect traffic only after deceptive emails have reached corporate mailboxes or users have initiated outbound connections. These tools lack continuous outside-in visibility into newly registered, taken, and available domain permutations being staged across global registrars.
ThreatNG operationalizes combosquatting defense by functioning as an unauthenticated external scout. Unifying External Attack Surface Management (EASM), Digital Risk Protection (DRP), and continuous Security Ratings into a single platform, ThreatNG discovers, evaluates, categorizes, and monitors an enterprise’s extended public digital perimeter alongside deceptive domain permutations from an outside-in, adversary-centric perspective. It correlates dormant domain registrations, newly provisioned certificates, and DNS records into deterministic attack paths via DarChain, evaluates weaponization probability through its 4-Dimensional (4D) Data Model, and delivers Legal-Grade Attribution without requiring internal software agents, API access keys, or administrative credentials.
External Discovery
Defending against combosquatting requires an automated, outside-in discovery tier capable of calculating, generating, and tracking thousands of mathematical permutations across global top-level domains before adversaries launch active campaigns. ThreatNG establishes this inventory baseline through connectorless external discovery.
Algorithmic Combosquatting Permutation Generation: ThreatNG automatically computes and evaluates permutations of corporate brand names, pairing core trademarks with targeted operational keywords. Security teams can define custom top-level domain (TLD) extensions and targeted keyword dictionaries (such as -login, -sso, -vpn, -auth, -portal, -support, -billing, and -vendor) to uncover combosquatted variations across global registries.
Taken vs. Available Domain Mapping: ThreatNG categorizes every generated combosquatted permutation into either taken (registered by a third party or the organization) or available. For taken domains, ThreatNG uncovers resolving IP addresses, authoritative nameservers, autonomous system numbers (ASNs), and active Mail Exchange (MX) records. For available domains, it identifies high-risk permutations suitable for proactive defensive acquisition.
Connectorless Asset and Perimeter Discovery: ThreatNG maps the entire public-facing digital footprint using unauthenticated discovery with zero internal connectors, software agents, or network credentials. It evaluates public domain registries, authoritative Domain Name System (DNS) zone files, Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate transparency logs, Regional Internet Registry (RIR) databases, and global Border Gateway Protocol (BGP) routing tables to catalog every legitimate public IP block, subdomain, cloud environment, and web application for correlation against suspicious staging infrastructure.
Decentralized and Web3 Domain Discovery: Beyond traditional DNS registries, ThreatNG identifies taken and available Web3 domains across decentralized naming platforms (such as the Ethereum Name Service/ENS and Unstoppable Domains), discovering decentralized brand hijacking attempts before phishing frontends resolve.
Subsidiary and Extended Ecosystem Scoping: Because ThreatNG operates without internal credentials or vendor permissions, organizations can execute unauthenticated discovery across operating subsidiaries, joint ventures, prospective acquisition targets (M&A due diligence), and critical supply chain partners to determine whether adversaries are staging combosquatted domains targeting trusted suppliers.
External Assessment
ThreatNG elevates the evaluation of combosquatted infrastructure from passive notifications to deterministic, evidence-backed assessment using its Known Vulnerability Exposure Verification (KVEV) engine, proprietary Security Ratings, and 4-Dimensional (4D) Data Model. The 4D model cross-references National Vulnerability Database (NVD) baselines, 30-day Exploit Prediction Scoring System (EPSS) probabilities, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) listings, and verified Proof-of-Concept (PoC) exploit code in DarCache eXploit.
Detailed Assessment Example 1: BEC & Phishing Susceptibility Assessment (Mail Staging Verification): ThreatNG’s Domain Intelligence module calculates a dedicated A through F BEC & Phishing Susceptibility score. The engine inspects taken combosquatted domains for newly configured MX records, evaluating whether threat actors have activated mail delivery capabilities. If a taken combosquatted domain (such as company-billing-portal.com) configures MX records pointing to high-volume mail services while lacking restrictive Sender Policy Framework (SPF) or DMARC authentication, ThreatNG flags the domain as an active pre-weaponization vector staged for Business Email Compromise (BEC) or invoice fraud.
Detailed Assessment Example 2: Brand Damage Susceptibility Assessment: ThreatNG evaluates discovered combosquatted domains, active homoglyphs, and unauthorized brand uses to assign an A through F Brand Damage Susceptibility rating. The assessment analyzes whether a combosquatted domain hosts cloned corporate logos, unauthorized e-commerce checkouts, or deceptive customer service contact forms, calculating the likelihood of public reputation loss and consumer fraud.
Detailed Assessment Example 3: Web Application Hijack Susceptibility on Lookalike Portals: ThreatNG evaluates web applications hosted on combosquatted domains for deceptive login pages and adversary-in-the-middle (AitM) reverse proxies. It calculates an A through F Web Application Hijack Susceptibility score based on external web components, verifying whether a fraudulent site is harvesting employee Single Sign-On (SSO) credentials or manipulating session tokens.
Detailed Assessment Example 4: Certificate Intelligence on Combosquatted Domains: ThreatNG inspects SSL/TLS certificates provisioned on taken permutation domains. The assessment analyzes certificate issuers, issuance dates, Subject Alternative Names (SANs), and validation levels. Detecting a freshly issued Let's Encrypt or ZeroSSL certificate on a dormant combosquatted domain indicates active adversary weaponization to establish browser padlock trust for a phishing campaign.
Detailed Assessment Example 5: Cyber Risk Exposure and Infrastructure Hosting Verification: ThreatNG analyzes the IP infrastructure hosting taken permutation domains. It evaluates shared hosting blocks, ASNs, geolocation, and neighboring domains to determine whether the combosquatted domain resides on bulletproof hosting infrastructure or known threat actor command-and-control networks, adjusting the Cyber Risk Exposure score accordingly.
Strategic Reporting
ThreatNG standardizes the communication of combosquatting risks by converting raw registrar records, infrastructure markers, and threat indicators into structured, auditable records for technical practitioners, executive leadership, and compliance auditors.
Executive Security Ratings Reports: ThreatNG converts complex permutation metrics and deceptive infrastructure data into standardized A through F security ratings across categories including BEC & Phishing Susceptibility, Brand Damage Susceptibility, Cyber Risk Exposure, and Non-Human Identity (NHI) Exposure. This enables Chief Information Security Officers (CISOs) to present empirical brand protection trends and proactive threat reduction metrics directly to corporate boards.
Correlation Evidence Questionnaires (CEQs): ThreatNG dynamically generates Correlation Evidence Questionnaires based on confirmed external discovery and assessment results. The CEQ acts as an EASM-to-Audit Translation Layer, transforming unauthenticated outside-in discoveries—such as staged phishing domains and missing email authentication records—into targeted, auditable inquiries mapped directly to regulatory frameworks across four functional pillars: Technical, Strategic, Operational, and Financial.
U.S. SEC Cybersecurity Disclosures Report: The report aligns an organization's public regulatory filings (such as Form 10-K Item 106 and Form 8-K Item 1.05 disclosures) with the verifiable technical reality of its external attack surface. It connects deceptive domain campaigns and active brand impersonation schemes to corporate disclosures, eliminating disclosure disconnects regarding material operational risks.
Forensic Evidence Packages for Preemptive Takedowns: When ThreatNG verifies a taken combosquatted domain configured with active MX records or newly issued SSL/TLS certificates, it compiles an auditable forensic package. This includes registrar records, IP routing details, HTTP response screenshots, DNS resolution histories, and proof of trademark ownership to support expedited Uniform Domain-Name Dispute-Resolution Policy (UDRP) filings and registrar abuse complaints before the domain dispatches malicious traffic.
Continuous Monitoring
Because adversaries register combosquatted domains, configure MX records, and deploy phishing landing pages in a matter of hours, static periodic scans leave wide exposure windows. ThreatNG delivers 24/7 continuous external surveillance across the extended digital footprint.
The platform monitors global registrar activity, zone file changes, newly issued certificates, and DNS record modifications in real time. If a previously dormant or available combosquatted domain is registered by a third party, or if a taken domain suddenly updates its DNS to point to active mail servers, ThreatNG detects the transition immediately. Furthermore, ThreatNG incorporates its Overwatch capability—a cross-entity vulnerability intelligence system that instantly evaluates exposure across an entire portfolio of subsidiaries, business units, and supply chain partners whenever an emerging brand impersonation wave or domain manipulation tactic is identified, alerting security operations within seconds.
Investigation Modules
ThreatNG features specialized investigation modules that allow security analysts to investigate discovered infrastructure, trace developer leaks, and evaluate the full intelligence context of combosquatted assets.
Detailed Module Example 1: Domain Intelligence and Permutations Module: Operating within Domain Intelligence, this module executes deep DNS analysis, evaluates domain record histories, and groups taken and available permutations. It provides exact IP addresses, ASNs, geographic hosting locations, and mail server configurations for every taken combosquatted domain. The module categorizes keyword pairings—such as separating administrative IT terms (-portal, -sso) from financial terms (-invoicing, -payroll)—allowing analysts to prioritize targeted executive campaigns over generic affiliate registrations.
Detailed Module Example 2: The DarChain Exploit Path Mapping Engine: DarChain (Digital Attack Risk Contextual Hyper-Analysis Insights Narrative) chains isolated technical, credential, and environmental indicators into predictive attack graphs. For example, DarChain maps how an attacker registers a combosquatted domain (company-vpn-login.com), secures a valid TLS certificate, correlates that domain with stolen employee credentials identified in dark web infostealer logs, and targets workforce identities to bypass multi-factor authentication (MFA), pinpointing the exact Attack Path Choke Point where blocking the domain severs the adversary's progression.
Detailed Module Example 3: Social Media and Conversational Attack Surface Module: This module monitors public profiles, hashtags, handle permutations, and link-sharing activities across social and messaging platforms. It identifies adversary campaigns that promote fraudulent combosquatted domains or impersonate corporate executives to execute social engineering and conversational fraud.
Detailed Module Example 4: Search Engine Exploitation Module: This module investigates an organization's susceptibility to information exposure via search engine indexing. It discovers when adversaries use search engine optimization (SEO) poisoning to rank deceptive combosquatted domains above legitimate enterprise web pages, diverting organic user traffic to credential-harvesting portals.
Detailed Module Example 5: Cybersecurity AI Prompts (DarcPrompt): DarcPrompt packages verified combosquatting context and attack path discoveries into structured prompt blueprints. Featuring specialized personas—such as Social Engineering and Brand Impersonation, External Attack Paths, and External GRC Assessment—DarcPrompt applies strict architectural constraints that bind the prompt to ThreatNG's proprietary ground truth. Through an Air-Gapped Handoff, security analysts safely copy these blueprints into their internal private enterprise AI systems to draft registrar takedown letters, employee warning advisories, and executive briefings without exposing sensitive asset data to public AI services.
Intelligence Repositories
ThreatNG centralizes and structures threat intelligence through the DarCache intelligence engine, providing an interconnected dynamic ecosystem that grounds combosquatting defense in empirical adversary reality:
DarCache Dark Web & Rupture: Scans underground forums, paste sites, and dark web sources for threats to brand assets and personnel, while tracking compromised corporate credentials, session cookies, and data leaks across all domain permutations. If a staged combosquatted domain is discussed on illicit forums or paired with leaked corporate data, Rupture confirms the domain is tied to an active cybercrime operation.
DarCache Infostealer: Parses dark web logs for compromised corporate credentials and active browser session tokens, allowing teams to determine whether threat actors possess valid credentials to pair with newly staged combosquatted phishing portals.
DarCache Vulnerability & eXploit: Integrates NVD baselines, CISA KEV listings, 30-day EPSS probabilities, and verified PoC exploit pointers to evaluate whether servers hosting combosquatted domains or connected enterprise gateways have weaponizable vulnerabilities.
DarCache Ransomware: Tracks active ransomware cartels and their specific tactics, techniques, and procedures (TTPs), monitoring whether threat actors are staging lookalike domains or acquiring specific infrastructure to target an organization or its industry sector.
DarCache Bug Bounty: Aggregates and analyzes historical bug bounty program disclosures, researcher activity trends, and crowdsourced exploit patterns to evaluate public perimeter assets under scrutiny by external researchers.
DarCache Mobile: Detects hardcoded access credentials, security keys, and platform-specific identifiers within public mobile applications, verifying whether mobile binaries reference deceptive combosquatted endpoints.
DarCache 8-K & ESG: Tracks SEC Form 8-K filings and global ESG violations, providing non-technical governance indicators that connect digital brand risks to financial materiality and corporate disclosure obligations.
DarCache BIN: Monitors Bank Identification Numbers (BINs) to identify and prevent potential payment card fraud across fraudulent e-commerce sites operating on combosquatted domains.
Cooperation with Complementary Solutions
ThreatNG functions as an external intelligence scout that cooperates seamlessly with complementary solutions across enterprise governance, risk, and security operations.
Cooperation with Secure Email Gateways (SEGs): ThreatNG passes taken combosquatted domains with active MX records directly to complementary solutions (enterprise SEGs). The email gateway uses this pre-weaponization intelligence to update inbound blocklists and domain-impersonation filtering rules, quarantining incoming phishing emails before they reach employee inboxes.
Cooperation with Protective DNS Resolvers and Secure Web Gateways (SWGs): ThreatNG feeds verified taken combosquatted domains into complementary solutions (protective DNS resolvers, firewalls, and SWGs). Corporate endpoints and web filtering proxies automatically block outbound DNS resolution and web traffic to those malicious destinations, preventing employees from loading credential-harvesting landing pages.
Cooperation with Security Orchestration, Automation, and Response (SOAR): ThreatNG delivers verified lookalike domain alerts and DarChain attack paths to complementary solutions (SOAR platforms) via an API. When ThreatNG flags a newly staged combosquatted domain with active MX records mimicking corporate Single Sign-On (SSO), the SOAR platform executes automated containment playbooks—submitting block requests to firewalls, updating email filters, and opening priority Jira incident tickets.
Cooperation with Brand Protection and Takedown Services: ThreatNG exports forensic evidence packages—including DNS resolution histories, registrar metadata, and HTTP screenshots—to complementary solutions (external brand protection and takedown platforms). These services use ThreatNG's legal-grade proof to initiate expedited registrar dispute proceedings and UDRP filings, accelerating the takedown of malicious infrastructure before it is weaponized.
Cooperation with Cyber Asset Attack Surface Management (CAASM) and CMDBs: ThreatNG feeds external asset inventories, newly discovered subdomains, and shadow cloud infrastructure into complementary solutions (CAASM platforms and CMDBs). IT and asset management teams use this feed to reconcile external discoveries against internal records, ensuring that all deployed web assets, cloud buckets, and domain names have assigned owners and documented decommissioning procedures.
Examples of ThreatNG Helping Organizations
Neutralizing Staged Single Sign-On Phishing Infrastructure: ThreatNG’s Domain Name Permutations capability discovered a newly registered combosquatted domain (company-sso-portal.com) combining the corporate brand with authentication keywords. ThreatNG detected that the domain had an active Let's Encrypt SSL/TLS certificate and MX records pointing to an unvetted mail provider. ThreatNG assigned an F score for BEC & Phishing Susceptibility and generated an alert. The security team investigated and uncovered a cloned Okta login page designed to harvest employee credentials during an open enrollment period. The team blocked the domain across the perimeter and filed an emergency registrar complaint, neutralizing the phishing infrastructure before emails were dispatched.
Defensive Registration of High-Risk Combosquatted Variations: During an unauthenticated baseline assessment, ThreatNG generated an inventory of available and taken combosquatted domain permutations, identifying high-risk combinations of the company’s name paired with financial and operational terms (such as company-billing-portal.com and company-vendor-invoices.com). Because the domains were currently available, ThreatNG flagged them under Brand Damage Susceptibility as high-probability attack vectors. Corporate security and legal teams purchased the identified combosquats defensively and established automated redirection to the authoritative corporate homepage, permanently denying the infrastructure to threat actors.
Examples of ThreatNG Working with Complementary Solutions
Working with Secure Email Gateways to Block Vendor Invoice Fraud: ThreatNG discovers a taken combosquatted domain (company-accounts-payable.net) with active MX records pointing to a known spam-associated mail host. ThreatNG transmits the domain name and mail server records to complementary solutions (an enterprise Secure Email Gateway). The email gateway immediately adds the domain to its global blocklist, stopping a spear-phishing campaign that attempted to send fraudulent wire-transfer instructions to accounting personnel.
Working with SOAR and Firewalls to Block Reverse Proxies: ThreatNG discovers an active combosquatted domain (login-enterprise-sso.net) hosting a cloned corporate identity portal and assigns an F Web Application Hijack Susceptibility rating. ThreatNG transmits a pre-correlated Context Object to complementary solutions (a SOAR platform). The SOAR system automatically triggers API commands to complementary solutions (protective DNS resolvers and enterprise firewalls) to block outbound traffic to the resolving IP and domain, preventing users from reaching the credential-harvesting site.
Frequently Asked Questions
How does ThreatNG discover combosquatted domains without internal software agents?
ThreatNG operates entirely as an unauthenticated external scout. It continuously evaluates public domain registries, DNS zone files, SSL/TLS certificate transparency logs, BGP routing announcements, and threat intelligence sources across the open internet, discovering taken and available lookalike domains strictly from an external adversary's viewpoint.
What is the difference between combosquatting and typosquatting in ThreatNG?
Typosquatting involves accidental misspellings, character omissions, or keyboard slips of the brand name itself (e.g., exampel.com). Combosquatting involves the brand name spelled completely correctly, but paired with operational, financial, or security keywords (e.g., example-security.com). ThreatNG generates, categorizes, and assesses both variants across global top-level domains.
How does ThreatNG cooperate with complementary security platforms during a combosquatting attack?
ThreatNG acts as an external intelligence scout that feeds pre-correlated Context Objects, verified malicious domains, and DarcPrompt blueprints directly into complementary solutions like Secure Email Gateways, protective DNS resolvers, SIEM platforms, SOAR engines, and brand takedown services, driving automated perimeter blocking, threat correlation, and rapid infrastructure suspension.
Immediate Actionable Verification Checklist
Conduct Recursive Outside-In Permutation Discovery: Initiate an unauthenticated scan across corporate brand seeds to calculate, identify, and group all taken and available combosquatted variations across global registries.
Review the BEC & Phishing Susceptibility Score: Inspect all taken combosquatted domains with active MX records to identify and isolate pre-weaponized adversary mail infrastructure.
Audit High-Risk Available Domains for Defensive Acquisition: Evaluate the list of available operational keywords paired with core trademarks to execute proactive defensive registrations on brand-critical combinations.
Deploy Context Objects into Automated Containment Workflows: Configure the delivery of pre-correlated external domain findings into complementary SOAR playbooks and Secure Email Gateways to automate domain blocking upon registration detection.
Compile Forensic Evidence Packages for Active Infringements: Ingest ThreatNG's outside-in evidence packages to initiate rapid UDRP complaints and registrar takedown procedures against fraudulent sites actively impersonating corporate brands.
