[t0k0l0sh]

I've done the same for about 20 years, usually using <company>@<mydomain> or <theirdomain>@<mydomain>

When I start receiving spam at one of these aliases, I'll update my email address with the relevant site(s), then after a cooldown period to ensure no more legitimate mail arrives at the original alias, I'll use the original alias as a spam trap - any mail sent to it is learned as spam, then accepted and discarded by my MTA.