Companies that run cold email at scale buy secondary "burner" domains to protect their main domain's reputation. Those burner domains forward back to the primary. If you can detect that pattern, you've found a team that already believes in outbound.
The signal
Multiple lookalike domains (companyhq.com, getcompany.com, trycompany.io) all resolving or forwarding to the same primary domain is a fingerprint for active cold email operations.
Why it converts
You're not convincing them outbound works, they're already doing it. You're selling better data, better deliverability, or more capacity. The first line writes itself: "Saw a few secondary domains forwarding to your main one, are you using them for outreach?"
For a data-enrichment client, targeting only companies with detectable burner domains turned a cold list into a warm one, because every prospect was pre-qualified as an outbound buyer.