You registered a domain and the offers started: where do these emails come from?

A few hours after you register a domain and put a site live, emails like this start landing: “We reviewed your website and found areas to improve in your links and metadata. We would be happy to send a free report.” They arrive even before Google has crawled the site. That is not a coincidence; there is a technical explanation for how they found you.

How they find you

Two sources are enough. The first is certificate transparency logs. The moment an SSL certificate is issued for your site, your domain is written into a public log. The mechanism exists so that mis-issued certificates can be caught, and the entries become public within seconds. Marketing list builders scan those logs continuously.

The second is domain registration data and zone files. Newly registered domains are distributed as daily lists. Put the two together and you are on a target list before the site is even finished.

A real review, or a template?

Telling them apart is not difficult. If two of these signs are present, the message is a template:

• Not a single concrete finding. “Links, metadata and site structure” could be written about any site. Someone who actually looked names a page: “the title tag is missing on this page”.
• Your domain has been dropped into a template. A capitalisation slip, a missing extension or wording that does not sit in the sentence usually gives it away.
• No company details in the signature. There is a name and a job title, but no company, phone, address or website. A real agency shows its own site first.
• You are asked to reply with a specific phrase. Lines such as “just reply send the proposal” are there to confirm that your address is live, not to make replying easier.
• There is an unrelated extra promise. An AI sentence tacked onto an SEO offer shows the message was written to whatever is currently in fashion.

Why replying is risky

Even “not interested” tells them something: this address is live, it is read, and there is a real person behind it. Addresses confirmed as live are worth more on a list; the frequency goes up and your address is sold on. The same logic applies to messages that collect an open signal by loading a single image.

More importantly, some of these messages are not sales at all but reconnaissance. Which addresses reply, who does what in the organisation and how you write are the raw material for a targeted fraud attempt later on.

What to do

• Do not reply. Do not click the links or open the attachments.
• Mark it as junk. Marking teaches the filter to recognise the next one.
• Block the sending domain if it repeats. On Microsoft 365, a tenant-level block list or a mail flow rule makes that permanent.
• Tell your team. The real risk is the genuinely harmful message mixed in among these.
• Use privacy protection on your domain registration. Contact details left open in the registry are the easiest way onto a list.

What a real audit looks like

A site audit is work done address by address, and it produces evidence: the HTTP response of every page, title and description lengths, heading structure, whether internal links resolve, whether language tags point at each other on a multilingual site, what the sitemap contains. The output is not “there are areas to improve” but a list showing which finding sits at which address.

We audit our own site the same way; every page goes through these checks before it goes live. We apply the same approach to our customers’ sites: see our Website and Digital Management and Cyber Security pages for details.

This article is for information only and does not constitute legal advice. It describes the regulatory framework in Turkey.