Phishing emails about your domain or website

If you own a domain, you will get scam emails about it. They claim your domain is expiring, your website has been suspended, someone is trying to register your name in another country, or your site breaks copyright law. The safe habit is simple: never click a link or call a number in an email about your domain. Open your registrar or website account yourself, by typing its address or using a bookmark, and see whether anything is actually wrong there.

Why domain owners get so many of these

Domain registrations are partly public. Even where your personal details are hidden, the domain name, its registrar and its expiry date can be looked up by anyone, and your business email is often printed on your own website. Scammers collect all of this in bulk. They know roughly when your renewal is due, which company you use, and what your business does. That makes their emails look specific, which is exactly what makes them work.

The common types, and what gives them away

"Your domain is expiring" or "domain suspended"

The email says your domain will be deleted today unless you pay or "verify". It often uses a logo that looks like your registrar's.

Signs it is fake:

The sender address is not your registrar's real domain, or is a long string of random words.
The link, when you hold your finger on it (phone) or hover the mouse (computer), goes to an unfamiliar address.
The deadline is hours away. Real registrars send several reminders over weeks, and domains have a grace period after expiry.

"Search engine registration" or "domain listing" invoices

These look like a bill for your domain, but in the small print they sell a listing in a directory nobody uses, or "submission to search engines". Google does not charge to include a website, and no one needs to "submit" you for a fee. Paying gets you nothing useful. Domain renewal scam letters and emails covers the paper versions that arrive in the mail too.

"Someone wants to register your name in Asia"

A company says another business is about to register your name with a foreign ending, and offers you the chance to buy it first. There is no other business. The goal is to sell you several overpriced domains you do not need. Ignore it.

"Your website has copyright violations" or "legal notice"

The email claims a photo on your site infringes someone's copyright and links to the "evidence". The link downloads malware or leads to a fake login. Real copyright complaints usually name the exact image and page, and do not ask you to download a file to see it. If you are worried a notice might be real, show it to your attorney before replying.

"Your site is down" or "payment failed" from your website builder

A fake message from Wix, Squarespace, GoDaddy or your host says your payment failed and the site will go offline. It links to a page that asks for your login and card. Your builder's own dashboard will show a real billing problem the moment you sign in yourself.

"SEO" offers with alarming audits

"We noticed your website has dozens of critical errors and is invisible on Google." These cold emails are sales pitches, not phishing in the strict sense, but they use the same pressure. Nobody can honestly promise you a ranking. SEO scam offers to ignore explains how to tell a pitch from a real problem.

Some real emails look scary too

Not every alarming email is fake, which is why "check yourself" beats "delete everything":

Domain contact verification. Registrars are required to confirm your contact email when you register a domain or change its owner details. If you ignore that email, the domain can be suspended. A real one arrives right after you bought, transferred or edited the domain.
Renewal reminders from your actual registrar, sent weeks before the date.
Security alerts from Google or Microsoft about a new sign-in.

The test is the same for all of them: sign in by your own route and see whether the account shows the same warning.

How to check a suspicious email in two minutes

Do not click, reply or call any number in the email.
Look at the real sender address, not the display name. Tap or click the name to reveal the address.
Check the link destination by hovering or long-pressing without opening it.
Sign in to your account directly and look for the same notice under domains, billing or messages.
Check your domain's expiry date yourself at ICANN's lookup tool. If it is months away, the "expiring today" email is a lie.
Call the company using the phone number on its real website, not the one in the email, if you are still unsure.

If you already clicked or typed your password

Act quickly, in this order:

Change the password of the account you typed it into, from the real site, and of any other account using the same password.
Turn on two-factor sign-in if it is not on. Two-factor authentication for your domain and email shows how.
Check the account for changes you did not make: new users, changed contact email, changed DNS records, a transfer request.
If you entered card details, call your bank and ask them to block the card.
If you downloaded a file, stop using that computer for business logins and have it checked.
Report the scam. The FTC takes reports through ftc.gov, and most registrars have an abuse address for fake emails that use their name.

Make yourself a harder target

Keep auto-renew on and a current card on file, so a real expiry never surprises you and fake ones are easy to dismiss.
Use a different email address for your registrar account than the one printed on your website.
Turn on the registrar's transfer lock, which stops anyone from moving your domain away without unlocking it first.
Tell staff the rule: domain and website emails go to you, and nobody clicks through to pay.

This week

Bookmark the login pages for your registrar, website and email.
Look up your domain's real expiry date and write it down.
Check that the contact email on your domain account is one you read.
Forward this rule to anyone who handles your mail.

If the scam emails are what reminded you that your site is overdue for attention, you can see your site rebuilt first and judge the new version in your own time.