How it works
The laziest version of brand impersonation skips the fake domain entirely and just uses a free mailbox. The display name and signature say ExpressVPN, the body describes a real-sounding VPN campaign, but the actual address is on gmail.com, outlook.com, yahoo.com, proton.me, or similar. Sometimes they load the brand name into the part before the @ to sell it (expressvpn.official@gmail.com, expressvpnpartners@outlook.com) so a glance reads "expressvpn" before your eye reaches the @ sign. A company running a paid creator program does not send those offers from a personal inbox. This is common because it costs the scammer nothing and no domain has to be registered.
The tell-tale signals
- The address after the @ is a consumer webmail provider, not expressvpn.com. Real ExpressVPN outreach comes from expressvpn.com or their affiliate portal.
- The brand name may be stuffed into the part before the @ to fake authority.
- Reply-to may point at a second free address or a messenger handle.
- The offer often pushes you toward Telegram or WhatsApp to continue, which pulls it off email.
What to do
Read the part after the @, every time. If a household-name VPN is writing you from Gmail, Outlook, or any personal provider, that alone is enough to stop. Do not reply with your rates or your channel details. Verify by going to expressvpn.com and using their listed partnerships or affiliate contact. If the sender tries to move you to Telegram or WhatsApp, that is a second red flag stacked on the first, and legitimate sponsors keep the negotiation on email. Mark it as spam and move on, because there is nothing here worth salvaging.