Fake Domain Renewal Invoices and “Your Domain Has Expired” Emails: How to Spot the Scam

An email arrives saying a domain is about to expire, with a link to renew it right now. It's easy to assume a scam like this only catches someone careless, but the whole design of these emails is aimed at a busy, reasonable person quickly clearing an inbox — not at anyone's carelessness specifically. It looks urgent, it has the domain name in it, and it might even look professionally designed. Fake domain renewal notices like this are a well-documented, ongoing scam pattern — security researchers flagged a fresh wave of them again in 2026 — and they work precisely because they mimic the one email a domain owner actually expects to see eventually. Here's how to tell a real one from a fake, what other domain scams tend to travel alongside it, and exactly what to do the moment one lands in your inbox.

What these scam emails typically look like

The specifics vary, but the pattern is consistent enough to recognise:

• Urgent language. Phrases like “act immediately” or “you will lose your domain” are designed to get a payment made before anyone stops to check the details carefully.
• A name that sounds official but isn't the real registrar. The email may reference a company name that sounds plausible — sometimes even professionally branded — but doesn't match who the domain was actually registered with.
• A fine-print disclaimer. Some versions include small text saying “this is not a bill” while the rest of the email is written to look exactly like one, which is a way of avoiding liability for what otherwise reads as a genuine invoice.
• A fake “lookup” page. Clicking through sometimes leads to a page that appears to search WHOIS records live — “connecting to registry”, “fetching records” — before showing the domain back, purely to make the whole thing look more legitimate.
• A generic greeting. “Dear Domain Owner” rather than the actual name on the registration — a real registrar's system already knows exactly who it's billing.
• An unusual payment method or link. A payment page hosted somewhere unrelated to the sender's own domain, or one asking for card details in a way that doesn't match how the real registrar normally bills.

No single item on this list proves a scam on its own — a real email can occasionally use urgent-sounding language too. It's the combination, and above all the mismatch between the sender and the actual registrar, that gives it away.

A worked example: anatomy of a 2026 scam email

A typical version reads something like: “Domain Services Notice — Your domain [yourdomain.com] registration expires soon. Renew now to avoid losing your website and email.” The domain name is genuinely correct, which makes it feel personal and specific rather than a mass mailing — but a domain name is public information by design, so including it correctly proves nothing about who actually sent the email. Below the headline sits a “Renew Now” button in a bright colour, a countdown-style phrase about days remaining, and, in some versions, small print reading “this is not a bill” tucked well below the fold where it's easy to miss entirely.

What makes 2026's wave notably harder to spot on sight is that many are now written with AI assistance — the English reads fluently, the layout looks professionally designed, and the tone can closely mirror a real registrar's, none of which was reliably true of the clumsier scam emails from a few years ago. The tell has moved from spotting bad writing to checking the sender and the facts, which is exactly what the comparison and steps below focus on instead.

Real renewal email vs scam at a glance

None of these signals is hard to fake individually, which is exactly why checking the sender and logging in independently — rather than trying to judge the email's tone or design — is the check that actually holds up.

Other domain-related scams — and why WHOIS makes Malaysian businesses an easy target

Fake renewal invoices are the most common version, but the same playbook shows up wearing different names:

• The unsolicited transfer notice. An email claims your domain is being transferred or is at risk of being “lost to a competitor” unless you act, trying to trigger a panicked click that actually authorises a real unauthorised transfer.
• The directory-listing or SEO-submission invoice. A notice offers to list your business, domain or trademark in a “registry” or search directory for a one-time or annual fee, dressed up to look like a mandatory official filing rather than the optional, low-value service it actually is.
• The trademark or business-name “protection” notice. A letter warns that a third party is trying to register a name similar to yours and asks for a payment to “secure” or “protect” it, borrowing the look of an official trademark filing to collect an unnecessary fee.
• The fake “account suspended” notice. An email claims a hosting or email account tied to the domain has been suspended for a billing issue, pushing the recipient to “restore access” through a link that actually harvests login credentials rather than fixing anything.

A business that has already seen one of these should expect the others eventually, since a domain name that surfaces in one scam list is routinely resold or shared to others running a different version of the same approach.

These all rely on the same raw material: a domain's registration details are recorded in a publicly queryable WHOIS record by default, and scam senders routinely scrape those records, or simply guess likely contact addresses from the domain name itself, to build target lists at scale. A Malaysian business's SSM registration and domain WHOIS record are both, by default, discoverable public information, which is exactly why a scam email landing in an inbox doesn't necessarily mean anything was hacked — it can simply mean the domain is publicly registered and visible, the same as every other domain on the internet. WHOIS privacy protection, covered further below, is the direct answer to this specific exposure.

The sender address is usually the first tell

A company claiming to run a serious registration business with round-the-clock support sending a billing notice from an ordinary free email address is a strong signal something's wrong — a legitimate registrar's billing communication comes from its own domain, not a generic inbox. It's worth actually checking the full sender address rather than just the display name, since a display name can say anything the sender wants regardless of where the email actually came from.

Verify independently, never through the email itself

The single most reliable check: ignore every link and button in the email completely, open a browser, and type in the address of the registrar the domain was actually registered with — not whatever's mentioned in the email. Log in there directly and check the real expiry date. If it doesn't match what the email claims, the email is fake. This takes two minutes and settles the question completely, without needing to examine the email itself for clues at all.

Domain lock and auto-renew as ongoing protection

Domain lock prevents a domain from being transferred to a different registrar without the owner's explicit authorisation — and an unauthorised transfer is exactly what some of these scams are actually trying to trigger behind a convincing-looking invoice. With lock enabled, that transfer simply can't complete even if a payment goes through. Auto-renew, separately, removes the actual expiry deadline that scam emails rely on for urgency in the first place — a domain that renews itself automatically each year never has a real “about to expire” moment for a scam email to convincingly imitate.

What to do the moment you spot a scam email

1. Do not click any link or button in the email, including an “unsubscribe” link — clicking it mainly confirms to the sender that your address is active and read.
2. Open a new browser tab and type your actual registrar's address yourself, then log in and check your domain's real status and expiry date there.
3. Report or delete the email using your inbox's spam or phishing report function, which helps your provider's filters catch the next wave sooner.
4. Check that domain lock is switched on in your registrar account while you're already logged in, since this is the single best protection against the transfer these scams are often fishing for.
5. Warn whoever else handles the domain — a colleague, a web designer, an accountant — since the same wave of emails is usually sent to every address associated with the business, not just one inbox.

What to do if a payment already went through

Contact the bank or card provider immediately to report the charge and ask about a chargeback, since these are almost always fraudulent charges rather than a real service ever being rendered. Then log into the real registrar account directly to confirm the domain's actual status and expiry date are unaffected, and change that account's password as a precaution — the same scam email may also have been a phishing attempt for those login details, not just a payment request.

Common mistakes

• Clicking through to “just check” what the email is offering. Even opening the linked page without entering any details can confirm to the sender that the address is live, inviting more of the same.
• Judging an email by how professional it looks. Design quality and fluent writing no longer separate real from fake now that many scams are written with AI assistance; only the sender's actual domain and an independent login check do.
• Assuming a scam email means the account was hacked. Most of these are sent based on public WHOIS data alone, with no breach involved at all.
• Letting domain lock sit switched off because it was never actively turned on at registration, leaving the one setting that blocks an unauthorised transfer unused.
• Letting only one person at the business see renewal-related emails. If that person is away or leaves, nobody else is positioned to tell a real renewal reminder from a fake one, or notice a scam wave at all.
• Paying first and checking later. Once a card payment clears, recovering it depends entirely on the bank's chargeback process, which is slower and less certain than simply verifying the claim before paying.
• Using the phone number printed in the scam email to “confirm” it. A number in the email itself is usually the scammer's own line, not the registrar's; look up the registrar's official contact details independently instead.

Where Gotka Technologies fits

None of these checks require any technical background — the whole approach comes down to trusting the registrar's own login page over anything an email claims, every single time, without exception for how convincing a particular message looks.

Gotka's domain registration includes domain lock and privacy protection as standard, alongside free transfer in, from RM10/year — the two protections that matter most against exactly this kind of scam. Knowing who your actual registrar is in the first place, covered in our guide on who actually owns your website, is the other half of staying safe from a fake renewal notice landing in an inbox.

Key terms used in this guide

• Registrar: the company a domain is actually registered and paid for through, which is the only place a genuine renewal notice should ever come from.
• WHOIS: the public record of a domain's registration details, which scam senders scrape to build target lists for fake renewal and other domain scams.
• Domain lock: a registrar-level setting that blocks a domain from being transferred to another registrar without the account holder's explicit authorisation.
• Privacy protection: a registrar service that keeps a registrant's personal contact details out of the public WHOIS record.
• Auto-renew: a setting that automatically renews a domain using the payment method on file before it expires, removing the hard deadline scam emails rely on.
• Phishing: an attempt to trick someone into revealing login details or making a payment by impersonating a trusted sender, which many fake renewal emails are a specific form of.
• Chargeback: a reversal of a card payment requested through the cardholder's bank, the usual recovery route after paying a fraudulent invoice.