How it works
This trick hides behind a word that sounds like exactly the department that would email a creator. The scammer keeps "surfshark" intact and attaches a business-sounding token: surfshark-partnerships.com, surfshark-media.com, surfsharkcollab.com, teamsurfshark.com, surfshark-creators.com. It reads as a real sub-brand or an outreach arm, so it can feel more credible than a bare typo, not less. Surfshark, ExpressVPN, and NordVPN all get this treatment because their real programs genuinely use words like "partners" and "creators," which gives the fake domains cover. The added word is the entire disguise, and the domain is not owned by the brand.
The tell-tale signals
- The real brand name is present but glued to an extra word or a hyphenated add-on. Surfshark's real domain is surfshark.com, with nothing bolted on.
- The add-on is a partnership-flavored word (collab, media, partners, team, creators, promo, official) chosen to sound like a real department.
- The domain is usually recent and lightly authenticated.
- Real Surfshark outreach comes from surfshark.com, and its Incogni deals may come from incogni.com or surfshark.com, never from a "-collab" spinoff.
What to do
Strip the sender in your head down to the registered domain and ask whether the brand actually owns that exact string. A real company sends creator mail from its primary domain, not from name-plus-a-word. Look up surfshark.com yourself and reach their partnerships team through the site. If you want a second opinion, run the raw email through a checker, which flags the bolted-on-words pattern specifically. Do not accept that surfshark-partners.com is Surfshark just because the word "partners" is in it. That word is the bait.