Every website owner eventually gets an email that looks official: a domain about to expire, a registrar asking you to approve a transfer, a hosting account flagged for suspension. Most of these are scams designed to get you to click, log in, or pay before you stop to think. Here is how the common ones work and how to check whether a notice is real before you act on it.
The fake “your domain is expiring” renewal notice
This is the oldest trick in the book. You get an email or even a printed letter warning that your domain will be deleted unless you “renew” immediately through a link in the message. The company sending it is often not your actual registrar at all — it just looked up your domain in the public WHOIS records and copied your name and expiry date to make the notice look convincing.
The real giveaway is the sender’s domain name and the renewal price, which is usually inflated. Your actual registrar renewal reminders come from the same account where you registered the domain, not a third party you’ve never dealt with.
The fake registrar transfer approval
These emails ask you to “click to approve” or “confirm” a transfer of your domain to another registrar, sometimes claiming your account will be locked if you don’t respond within 24 hours. The urgency is the point — it’s meant to stop you from checking first. If you didn’t personally start a transfer, the correct move is to ignore the email and log in to your existing registrar account directly to confirm nothing is actually pending. You can read more about how legitimate transfers work on our domain transfer page.
Spoofed cPanel and WordPress login emails
Attackers send emails styled to look like cPanel or WordPress security alerts — “unusual login detected,” “your account has been locked,” “verify your identity to restore access.” The link goes to a fake login page that captures your username and password the moment you type them in. cPanel and WordPress do send real notifications, but neither will ever ask you to “verify” your password through an email link. If in doubt, don’t click anything in the email at all.
Fake SEO listing and directory invoices
Another common one aimed at business owners: an invoice-looking email for a “search engine listing,” “business directory renewal,” or “Google index fee.” These rely on the recipient assuming it’s a routine bill from a service they signed up for long ago and forgot about. There is no fee required to appear in search results or on Google Maps, and a real invoice from your hosting provider will always match a service you actually purchased.
Fake hosting account suspension warnings
These messages claim your hosting account will be suspended for a billing problem, a policy violation, or a security issue, with a link to “resolve it now.” The link usually leads to a page asking for your hosting or billing login. Genuine suspension notices from a real host reference your actual account details and never ask you to re-enter your password through an email link — they direct you to log in through your usual client area, which you should reach by typing the address yourself rather than clicking through.
How to check any notice before you act on it
A few habits catch almost all of these scams before they cause any damage:
- Check WHOIS yourself. Look up your domain’s actual registrar and expiry date using a WHOIS lookup rather than trusting the dates quoted in an email.
- Never click through — type the URL. Open a new browser tab and type your registrar’s or host’s address directly, then log in from there. If there really is an issue, it will show up in your account.
- Look at the actual sender domain, not just the display name. A message claiming to be from your registrar but sent from a free email address or an unrelated domain is not legitimate.
- Turn on two-factor authentication on your registrar, hosting, and email accounts, so a stolen password alone isn’t enough to get in.
- Use unique passwords for your domain registrar, hosting account, and email — reusing one password across all three means one leak compromises everything.
- Enable registrar lock on your domain so it can’t be transferred away without extra verification steps.
If you’ve already clicked a suspicious link and entered a password, change that password immediately (and anywhere else you reused it), check your registrar and hosting account for any changes you didn’t make, and contact your registrar or host’s support to flag the incident. Reviewing our website security basics guide is also a good next step to lock down the rest of your account. For general background on how domains and registration actually work, our domain names explained guide covers the fundamentals, and ICANN publishes independent guidance on registrant rights and transfer rules.
Frequently asked questions
How do I know if a renewal email is really from my registrar?
Check the sender’s email domain against your registrar’s official domain, and compare the price and account details to what’s actually in your account. When unsure, log in directly by typing the registrar’s address into your browser instead of clicking the email link.
Can a phishing email actually transfer my domain away from me?
Not just from an email — a transfer normally requires confirmation through your registrar account and an authorization code. That’s exactly why registrar lock and two-factor authentication are worth turning on, since they add steps an attacker can’t fake.
What should I do if I already entered my password on a fake login page?
Change that password immediately, along with any other account using the same one, check for unauthorized changes in your registrar and hosting accounts, and contact support to report it.
Do hosting companies really email about suspended accounts?
Yes, but a genuine notice will reference your specific account and direct you to log in through your normal client area rather than asking you to “verify” your password by clicking a link.
Is there a real fee to get listed on Google or search engines?
No. There’s no charge to appear in organic search results or Google Maps listings, so any invoice claiming otherwise is not legitimate.
Protect your website with hosting built on cPanel and LiteSpeed, and try it risk-free with our 3-day free trial on shared hosting.