Domain Expiration Scam December 2020

1. Home
2. Monkey Musings
3. Domain Expiration Scam December 2020

It's December — ‘Tis the season to be... trying to scam people

---

Name: Joe Miller
Email: info@domainworld.com
Message: Notice#: 491343
Date: 2020-12-22

YOUR IMMEDIATE ATTENTION TO THIS MESSAGE IS ABSOLUTELY NECESSARY!

YOUR DOMAIN [domain-removed] WILL BE TERMINATED WITHIN 24 HOURS

We have not received your payment for the renewal of your domain [domain-removed]

We have made several attempts to reach you by phone, to inform you regarding the TERMINATION of your domain [domain-removed]

CLICK HERE FOR SECURE ONLINE PAYMENT: http://yourdomaindefined.xyz/?n=[domain-removed]

---

The message above was sent to one of my clients today via the contact form on their website. On first glance it could look legitimate, and clicking the payment link forwards you to a reasonable facsimile of a real payment page. However, a few clues let us know this is a blantant scam.

• I have NEVER seen a domain company manually visit a website in an attempt to contact the owner regarding a late payment. Those systems are all automated and if you don't respond to any automated reminder emails sent to the address on file, they will simply shut your domain down and charge you extra to reinstate it.
• It states "We have made several attempts to reach you by phone" yet they don't show the contact phone number - because they don't have access to it.
• It only provides an email address and a payment URL (which don't match by the way). Legitimate registrars would also provide a phone number if they really wanted to get paid for thier services.
• The payment domain they direct you to is http://yourdomaindefined.xyz. Be highly suspect of any unusual domain extentions. There are almost 1000 (!) domain extentions available, and scammers love the unusual ones as they're available in bulk for almost nothing.
• And, diving just a bit deeper, by looking up the WHOIS info for this domain we can see it was registered less than 72 hours before this 'notice' was received.
  
  

 

How to Avoid This Scam

Always know where your domain is registered and when renewal is due! This client knew that we always handle their domain and hosting payments for them so they checked with us before submitting any payment — potentially saving them a fair bit of money.

As always, if you recieve an email you're concerned about, please feel free to forward it to us for review.