Recognize the pattern
How it starts
Urgent renewal messages in a domain management inbox.
The promise
Your domain will be suspended; renew cheaply through this link.
What happens next
Public domain details and familiar branding make a fake notice credible, collecting card details, credentials or misdirected renewal payments.
Signs to watch for
- Sender differs from the real registrar
- Expiry differs from the management console
- Requests a password through an unfamiliar link
Start with what you can do now
If this happened to you
Ask the real registrar to check the account
Reset exposed passwords and review changes
Keep fake notices and payment details; report them
What to save
Keep the original records. Use copies to organize the details.
- Renewal email and headers
- Impersonated URL
- Real domain expiry details
- Payment and management logs
Before you send money
- Use a saved registrar console address
- Record expiry dates and the real provider
- Enable MFA on domain accounts
These guides explain common patterns. The facts of your situation and your payment provider’s rules determine which steps are available.