Fake Domain and Hosting Renewal Notices: Spot the Scam

Short answer: A message that tells you to pay quickly to renew your domain, hosting or website listing is not always from the company you use. Some are real reminders, but many are invoices from unrelated sellers that hope you will pay without checking. Never pay from a link in the message. Log in to your registrar or host directly and see whether anything is really due.

What these notices look like

Domain owners are easy to find, because registration details have long been available through public lookups, and in many places they still are. Scammers collect them and send notices to the contact on file. The notices come in several forms.

The fake invoice. A letter or PDF that looks like a bill for “domain registration” or “domain listing”, with a price, a reference number and a payment deadline. The seller is not your registrar and the service is often worthless.
The urgent expiry warning. An email that says your domain will be suspended or lost unless you act within a day or two. Real renewal reminders exist, but real ones rarely threaten you with instant loss.
The transfer trap. A message that suggests you “confirm” or “renew” with a new company. If you agree, you may start a transfer of your domain to a different registrar without understanding it.
The search listing offer. A notice that claims your site must be “submitted” or “registered” with search engines for a fee. Search engines find sites on their own and do not charge for normal inclusion.
The fake certificate or hosting notice. An email that says your SSL certificate or hosting plan has expired and links to a page where you can pay.

The common thread is pressure. The aim is to make you act before you think.

Why they work

Domains and certificates really do expire, and losing a domain is a real disaster for a business. People who are not sure how their domain is managed assume that a notice must be genuine. In small companies the person who receives the mail is often not the person who set up the domain years ago, so nobody remembers which company is the registrar.

Fake invoices are also designed to pass through accounting. A bill for a modest amount, with a reference number and a business-like layout, can be paid by an assistant who assumes someone ordered it. The money is lost, and sometimes the payer has also agreed to a contract that renews every year.

Warning signs

The sender is not your registrar. Compare the company name with the registrar shown in your account. If you have never heard of the company, treat the notice as suspicious.
The email address does not match the company. Look at the real address behind the display name, and at the domain after the at sign. A lookalike address is a warning. The article on lookalike domains and typosquatting explains how these are built.
It does not name your domain correctly. A genuine reminder gives the exact domain and your account details. A scam may use a generic greeting or a wrong spelling.
It asks for payment by a method you do not normally use. Gift cards, bank transfers to a new account and cryptocurrency are signs of fraud.
It contains a threat or a very short deadline. “Your site goes offline in 24 hours” is meant to stop you from checking.
It links to a login page that you did not ask for. A fake login page steals your registrar password, which is worse than losing the invoice amount.
The price is far from what you pay. Compare it with your last real renewal.

How to check a notice in five minutes

Do not click. Leave the links and attachments alone.
Find your registrar. Look in your records or in the registration details for your domain, which public lookup tools can show. The registrar is the company you pay for the name.
Log in the normal way. Type the registrar address in the browser or use a saved bookmark, and sign in.
Look at the expiry date and the renewal status. If the domain is not close to expiry, or if automatic renewal is on, the notice is not needed.
Ask a colleague. Someone else may know that a plan was changed or an agency handles the domain.
Report and delete. Tell the people who handle bills that the notice is false, so that nobody pays it later.

If you have already paid or entered a password, act quickly. Contact your bank, change the registrar password and turn on two-step sign-in. Then check that the domain is still in your name and that its DNS settings have not changed.

Real renewal reminders look different

Registrars and hosts do send expiry reminders, and they are useful. A real reminder comes from the company with which you have an account, names your exact domain, and takes you to the same site where you log in. It does not offer a surprise new service. It is usually sent several times in the weeks before expiry, and it is easy to confirm by checking your account. The article on what happens when a domain lapses explains the timeline, including the grace period after the date.

Make sure these real reminders reach someone who will act on them. Use a shared mailbox for domain contacts, not the address of one employee who may leave.

How to protect your domain

Turn on automatic renewal with a payment method that does not expire soon, and set a calendar reminder as a second check.
Use a registrar lock. It blocks unwanted transfers. The guide to domain hijacking and registrar locks explains how it works.
Protect the account. Use a strong, unique password and two-step sign-in, as described in the guide to two-factor authentication for website owners.
Keep contact details current. Use a role address, not a personal one, and keep the registrant details accurate.
Write down who is responsible. One named person should own domains, DNS, hosting and certificates, and know where the invoices should come from.
Tell the team. A short note to staff who open mail and pay bills prevents most losses. Fake invoices work because someone assumes that another person ordered the service.

What to do if you already paid or clicked

Mistakes happen, and a fast response limits the damage. The steps depend on what you did.

You paid by card or bank transfer. Call your bank or card issuer straight away. A payment that is reported quickly has a better chance of being stopped or reversed. Keep the notice, the payment receipt and any emails.
You typed a password on a page that came from the message. Change that password at once on the real site, and on every other site where you used it. Turn on two-step sign-in. Then look at the account history for logins or changes you do not recognise.
You opened an attachment. Run a security scan on that computer and tell whoever manages your devices. Attachments in fake invoices are sometimes harmless PDFs, but they can also carry malware.
You agreed to a transfer. Contact your original registrar immediately and ask them to stop or cancel the transfer. A registrar lock and the transfer authorisation code are the controls that matter here, and the registrar can explain the next step.

After the incident, check the basics of the site itself. Confirm that the domain still points to your server, that your email records are unchanged and that your certificate is valid. If something looks wrong, treat it as a security incident and follow the plan in the guide to responding to a data breach.

Why a written process beats memory

Most losses from fake notices come from confusion inside the company, not from clever technology. Nobody knows which company holds the domain, who pays for hosting or which supplier sends the invoices. A one-page record fixes this. Write down the registrar, the account owner, the renewal date, the payment method and the person who approves bills for each domain and hosting plan. Add the real sender addresses of your suppliers, so that a finance assistant can compare a new invoice against a known list.

Review the record once a year. It takes minutes, and it is also the document you need if a person leaves or a supplier changes.

How Site AI Audit helps

Site AI Audit cannot tell you whether a letter in your inbox is real, because that depends on your registrar account. It does show the things a renewal scam pretends to warn about: the expiry date of your SSL certificate, the redirect from HTTP to HTTPS, security headers and the DNS records for email. If your certificate is about to expire, the report says so, and that gives you a trusted reason to log in and check without relying on a message from a stranger. The free check covers up to 50 pages and needs no sign-up. You can run a free check of your website or see the plans for weekly monitoring and alerts.

The bottom line

A notice that asks for money is not proof that something is due. Check the sender, ignore the links and look at your own registrar account. Turn on automatic renewal, lock the domain and protect the account, so that the real reminders do the work and the false ones can be thrown away.

FAQ

Is every domain renewal email a scam?

No. Your registrar and host send real reminders. The test is whether the sender is the company you actually use and whether your account shows the same amount and date.

What if I already paid a fake invoice?

Contact your bank at once and ask whether the payment can be stopped. Then check that your domain, DNS and account details are unchanged, and keep a copy of the notice in case you need to report it.

Can someone take my domain by sending a notice?

A notice alone cannot. Danger starts if you give away your login details or approve a transfer. A registrar lock and two-step sign-in make this much harder.

Do search engines charge to list my site?

No. Search engines find sites on their own, and offers to submit your site for a fee are not needed for normal inclusion in results.

Who should receive domain reminders?

A shared role mailbox that several people can read. Reminders sent to one person’s address are lost when that person leaves.