JianweiAI-assisted funds analysis
Contact the team

Business & invoices

Fake domain renewal notices

A fake registrar or authority sends an expiry notice that directs administrators to payment or credential theft pages.

See response steps Share this in a workshop
A person holding a payment card beside a laptop

If you have one minute

Pause, then verify independently.

Sender differs from the real registrar

Before paying

Use a saved registrar console address

See verification steps →

If you paid or shared details

Ask the real registrar to check the account

See response steps →

Start with these three signs

  • Sender differs from the real registrar
  • Expiry differs from the management console
  • Requests a password through an unfamiliar link

How the situation unfolds

  1. Contact

    Urgent renewal messages in a domain management inbox.

  2. The lure

    Your domain will be suspended; renew cheaply through this link.

  3. The demand and outcome

    Public domain details and familiar branding make a fake notice credible, collecting card details, credentials or misdirected renewal payments.

Verify these things before paying

  1. Use a saved registrar console address
  2. Record expiry dates and the real provider
  3. Enable MFA on domain accounts

Already engaged or paid?

  1. Ask the real registrar to check the account
  2. Reset exposed passwords and review changes
  3. Keep fake notices and payment details; report them

Contact your payment provider and local police promptly. The responsible institution must confirm whether a payment can be stopped, disputed or returned.

Keep these records

Renewal email and headers
Impersonated URL
Real domain expiry details
Payment and management logs

Keep originals and organise working copies. Never give strangers verification codes, banking passwords, private keys or seed phrases.

Original references

  • Internet Corporation for Assigned Names and Numbers (ICANN)Publisher location：International · EnglishOpen the original reference ↗https://www.icann.org/resources/pages/phishing-2013-05-03-en

This page summarises public prevention guidance to help recognise methods. It is not an enforcement conclusion about a particular incident. Check the source page for its original title. Procedures and reporting routes vary by jurisdiction. Compiled October 2026.

Related situations

Business email compromise

A fake executive, colleague or partner uses a spoofed or compromised mailbox to request urgent payments or confidential data.

Read the warning signs and checks

Payment redirection scams

A fake supplier changes bank details near a real payment deadline. The project and invoice are real; the recipient is not.

Read the warning signs and checks

Fake purchase orders

An impersonated company or school sends a large order with forged paperwork, requesting credit terms and fast delivery.

Read the warning signs and checks