Listen to the episode
TLDR
Scammers are sending fake domain renewal notices that mimic real registrar warnings, targeting website owners and small businesses. The email leads to a polished page branded Renovarix that appears to query your real WHOIS data, displays...
How it works
Scammers are sending fake domain renewal notices that mimic real registrar warnings, targeting website owners and small businesses. The email leads to a polished page branded Renovarix that appears to query your real WHOIS data, displays...
Red flags
- Sender address is a free Gmail account, not a matching company domain (e.g., a "London office" billing from @gmail.com). Fake urgency: red banners saying your domain expires in "03 days," 15 minute price countdowns, and guilt trip pop ups like "Wait — Your Domain Is At Risk!" "Registry ID" and renewal confirmation are fabricated client side
- no real registrar transaction occurs. What to do If you only opened/deleted the email: no action needed
- simply delete it. If you clicked the link: close the page, do not enter any data, clear your browser. If you submit
What to do
- 1Do not click, pay, install apps, or share verification codes.
- 2Verify through the official website, app, or phone number typed manually.
- 3If you already interacted, block cards or accounts and report the incident.
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/06/fake-domain-renewal-emails-trick-website-owners-into-paying-scammersFAQ
Is Fake domain renewal emails trick website owners into paying scammers a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Sender address is a free Gmail account, not a matching company domain (e.g., a "London office" billing from @gmail.com). Fake urgency: red banners saying your domain expires in "03 days," 15 minute price countdowns, and guilt trip pop ups like "Wait — Your Domain Is At Risk!" "Registry ID" and renewal confirmation are fabricated client side; no real registrar transaction occurs. What to do If you only opened/deleted the email: no action needed; simply delete it. If you clicked the link: close the page, do not enter any data, clear your browser. If you submit
What should I do first?
Do not click, pay, install apps, or share verification codes.; Verify through the official website, app, or phone number typed manually.; If you already interacted, block cards or accounts and report the incident.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.