Recognising phishing around domain names

Fake domain expiry notices are among the most effective kinds of phishing, because they look like an ordinary invoice.

How they are built

The sender resembles a registrar, the amount is plausible, and there is urgency: your domain supposedly expires in a few days. Often your real domain name is in it, because that data is public.

The most reliable signal

You never pay for a domain at a party where you did not register it. If the sender's name does not match your provider, it is fake, however convincing it looks.

Do not click the link

Log into your own account through the address you know and check the expiry date there. That settles it in thirty seconds.

The "search engine" variant

An invoice for a directory listing you never requested. Technically not phishing but hard selling — treat it the same way.

Warn your colleagues

These messages often arrive in accounts, not in IT. That is exactly where the check is missing.