Domain scams, and how to check in a minute.

Fake renewal notices and invoices.

An email or letter says your domain is about to expire and asks you to pay. The sender is not your registrar. In a campaign Malwarebytes described in June 2026, notices under the name "Renovarix" led to a page that showed the victim's real registrar and expiry date, which anyone can read from public records, then asked for name, address and phone number, then card details, with a countdown on a "special price"; the "Renew now" button renewed nothing[2].

An older version is domain slamming: a notice that looks like a renewal but moves the domain to another registrar, often at a higher price. In 2003 the US Federal Trade Commission settled with Domain Registry of America over mailings of this kind[3].

Some notices borrow ICANN's name and logo. ICANN does not process domain registrations or collect fees from registrants[4], and says it never sends domain expiration reminders or renewal requests[5].

• Find your registrar and the real expiry date in the registration record, and renew only in your account there.
• Never pay a renewal through a link in an email. Log in to the registrar the way you always do.
• A renewal priced far above what you paid last year is a warning sign on its own.

Buyers who ask you to pay first.

A message offers a good price for your domain but asks for an appraisal first, from a service the buyer names. The scammer runs that service or earns a commission on it, and disappears once the fee is paid[6]. The same pattern works with any paid step the buyer insists on before the sale.

• A real buyer pays for their own research. If you want a figure, get a free estimate yourself.
• Never pay a fee to a buyer, or to a service a buyer chose, to complete a sale.

Fake escrow and marketplace sites.

The buyer or seller insists on a particular escrow service. According to Escrow.com, fraudulent escrow sites use names close to real ones, give reasons why the other party cannot use a known service, take wire or person-to-person transfers, and often claim years in business on a domain registered weeks ago. A padlock in the address bar proves nothing, and unusually low fees are a warning sign[1].

• Type the escrow or marketplace address yourself; never follow a link from the other party.
• Check the site's domain age and call the phone number it lists.
• Be wary of a site that takes only wire transfers or person-to-person payments.

Phishing for your account and transfer code.

Some messages want your registrar login or the domain's transfer code (also called the auth code or AuthInfo code), which is what moves a domain to another registrar. Your registrar must give you that code within five calendar days when you ask for it, and after a change of registrant name, organization or email the domain cannot move to another registrar for 60 days, a rule meant to protect you from unauthorized transfers[7].

• Turn on the registrar lock, enable multi-factor sign-in, and use a different email address for your registrar account than the one in the domain's registration record[5].
• Give a transfer code only when you start a transfer yourself, or when an escrow service confirms it holds the buyer's money.
• If you get a transfer approval email you did not expect, decline it and call your registrar.