Look-alike domains reuse a trusted company's name with one word changed. How to read a domain properly, with a real example from book marketing.
A look-alike domain borrows the name of a company you might trust and changes one small thing. One word swapped. A letter added. A different ending. The aim is that you read the familiar part, feel reassured, and do not read the rest.
It works because people read domains the way they read words: by shape, not letter by letter.
Greenleaf Book Group is a well-regarded publisher and book-marketing company. Its domain is greenleafbookgroup.com.
I received an email from a "book-marketing agency" at greenleafbookagency.com. One word different. Group became Agency. Same first two words, same .com.
That is not Greenleaf Book Group. Anyone can register greenleafbookagency.com if it is available. The email traded on a good reputation the sender had no claim to.
If you glance at the address you see "greenleaf book". If you read it you see the swap.
Once you know the patterns you will see them everywhere.
The last one catches careful people. The part that decides who owns a domain is the segment immediately before the ending, and the ending itself. Everything to the left of that can be invented by the owner.
Take the address. Find the @ sign. Everything after it is the domain.
Now read it from the right.
For greenleafbookagency.com: ending .com, registered name greenleafbookagency. Not greenleafbookgroup.
For mail.greenleafbookgroup.com: ending .com, registered name greenleafbookgroup. That would be the real company, using a subdomain.
For greenleafbookgroup.mailhost-example.com: ending .com, registered name mailhost-example. Not the real company, whatever the left-hand words say.
Do this once slowly and it becomes automatic.
Never take the domain from the email as the reference. Find the real one yourself.
Open a new tab. Search for the company by name. Go to its website. Note the domain. Then compare it, character by character, with the address in the email.
If the company has a "contact us" page, the email addresses on it will use the real domain. That is your ground truth.
Established companies have old domains. Look-alikes are usually new.
A WHOIS lookup shows when a domain was registered. Type "whois" into a search engine, pick any of the free lookup services, and enter the domain. If a company that has apparently been around for years is emailing from a domain registered a few weeks ago, you have learned something useful.
Registration details are often hidden behind privacy services. That is normal and not suspicious by itself. The creation date is usually still visible.
Type the look-alike domain into a browser yourself, in a fresh tab, without clicking anything in the email. Three things can happen.
None of those is what a genuine established business looks like. A real company's site has a history, named staff, a physical address, and usually a registered company number you can check.
Authors are easy to find. Amazon pages, Goodreads, author websites and social profiles all list a name and a book. Many authors are new to publishing and unsure what a legitimate marketing offer looks like. Reputable names in the industry are well known, so borrowing one is effective.
It is not just books. The same technique is used against job seekers, small businesses, patients and anyone who deals with a well-known brand by email.
About 30 seconds, and the Greenleaf look-alike would have failed at step two.
The same domain reading applies to fake recruiter emails and fake media invitations. I have written separate guides for both, and one for what to do if you have already replied.
I am building Proof of Sender to do the comparison for you. Paste the sender's address and the company it claims to be, and it flags a domain that does not match. It is early and free. Try it at proofofsender.com/demo.
Not sure about an email in front of you right now? Check the sender free. It runs in your browser and nothing is stored.