A message lands in your inbox that looks like a routine notice from your provider. It includes your name, your exact domain, and an expiry date that is actually correct. Below it, a warning: the card payment failed, and unless your details are updated within 24 hours, your website and business email will stop working.
The sender looks official - the name of a large hosting or domain provider, and an address in the header that seems right. The "Renew domain" button opens a page that looks identical to the real customer portal. It asks for your username, password, and card details.
Everything entered on that page goes straight to the attacker: access to your account, and often your card. With access to the domain account, an attacker can redirect your website and email, or even transfer the domain to another account entirely.
How did they get my details?
What unsettles most people is how precise the message is. But none of it is secret.
The WHOIS registry. Every registered domain has a public WHOIS record showing the registrar, the expiry date, and the nameservers. Many registrars now partially redact personal details for privacy reasons, but the expiry date, the registrar, and often the company name or a contact email remain visible. There are also services that archive historical WHOIS records from the period when this information was fully public.
Automated bots. Attackers don't find victims by hand. Software scans millions of domains daily, logs expiry dates, collects email addresses from websites and contact pages, and sends messages automatically at exactly the moment a renewal is genuinely due.
Your website reveals a lot. The owner's name in the legal notice, the email on the contact page, the hosting provider visible from DNS records - all of it is public, and all of it is easily combined into a personalized message.
Why you get emails from a provider you don't even use
It's common to receive a notice in the name of a large, well-known hosting or domain provider, even though the domain isn't registered there at all. That isn't a mistake on the attacker's part. It's a numbers game.
Send a hundred thousand messages in the name of large, well-known companies, and some recipients really are customers, while others simply don't remember where everything is registered. A small percentage clicking is enough. It's also worth stating clearly: the provider itself has not been hacked here - attackers are only misusing its name.
The technical trick: how the sender address is faked
An email contains several fields that look similar but mean different things. That's where most of the deception happens.
- Display name. The text shown before the address, such as "Hosting Support". It can say anything - nothing verifies it.
- From. The address shown as the sender. It can be forged, and attackers frequently use an address that only resembles the real one - one letter off, or with additions like "-billing" or "-secure".
- Reply-To. The address your reply actually goes to. In scams it often differs from the From address and leads straight to the attacker.
- The real sending server. Only visible in the full message header, it shows where the email actually came from - usually a compromised server or a cheap bulk-sending service.
Reputable providers now protect their domains with policies (SPF, DKIM, and DMARC) that make it harder to forge their exact address directly. That's why attackers increasingly use addresses and domains that only look like the real thing. On a phone, where the full address is often hidden, almost nobody notices the difference.
Anatomy of a fake notice
Nearly every one of these messages contains the same ingredients:
- Urgency: "Your website and email will go offline in 24 hours."
- One accurate detail: the real domain and real expiry date, so the message feels verifiable.
- A payment problem: "card declined" or "payment failed", so asking for card details seems natural.
- One big button: "Renew now" or "Confirm details", leading to the fake page.
Before clicking, always hover over the button (on a phone, long-press the link) and check the real address. If it leads to an unfamiliar domain, an odd subdomain, or an address with extra words before or after the provider's name, it's a scam. The real domain is always read from the right, just before the first slash: in provider.com.domain-renewal.net, the actual domain is domain-renewal.net, not provider.com.
Genuine notice or phishing - how to tell them apart
| Element | Genuine notice | Phishing |
|---|---|---|
| Sender | The service's official domain | Spoofed or lookalike domain, different Reply-To |
| Link | Goes to the official portal | Goes to an unknown domain or suspicious subdomain |
| Tone | Informative, with a reasonable deadline | Panic, shutdown within 24 hours |
| Technical checks | Passes SPF, DKIM, and DMARC | Fails or missing on closer inspection |
Check and respond in four steps
1. Don't click anything in the email. Not the button, the link, or the attachment - even if every detail is correct.
2. Check the sender and Reply-To. Open the full message details (in Gmail: "Show original"; in Outlook: "Message properties"). Compare the From and Reply-To addresses and look at the authentication results - if SPF, DKIM, or DMARC show as failed, the email is almost certainly fake.
3. Log in directly. Type your registrar's or host's portal address into the browser yourself, or use a saved bookmark - never the link in the email.
4. Confirm the status in your account. If the domain really is expiring or a payment really failed, you'll see it in your account. If everything is fine there, delete the email and report it as phishing.
If you've already entered details on the fake page: change your password in the real portal immediately, enable two-factor authentication, ask your bank to block the card, and check whether your domain's DNS records or contact details have been changed.
Lasting protection: DNS policies and team habits
For your own domain, three DNS records make it much harder for anyone to send email in your name:
- SPF - a list of the servers allowed to send email on behalf of your domain.
- DKIM - a digital signature proving the message hasn't been altered and really came from your server.
- DMARC - a policy telling receiving servers what to do with messages that fail those checks: deliver them, send them to spam, or reject them.
Beyond that: enable two-factor authentication on your domain registrar, hosting, and business email accounts; turn on automatic renewal and the registrar's transfer lock where available; and agree as a team that any email about payments or "urgent" changes is verified directly in the account, not through the message.
Your domain is your company's address on the internet - your website, email, and reputation all depend on it. One rule stops most of these attacks: notices are verified by logging in, never by clicking.
