Domain Scams: 7 Tricks Aimed at Domain Owners and Buyers

If you own a domain that looks remotely valuable, you’ll get emails about it. Some are genuine offers. A larger share are scripts, sent to thousands of owners at once, built around one idea: getting you to pay something small before you receive something big.

Domain scams work because most owners rarely deal with domains. You renew once a year, you’ve never sold one, and you don’t know what a normal process looks like. The scams below are the ones that keep coming back, with the details that give them away.

1. The appraisal scam

The classic. It targets sellers, or people who didn’t know they were sellers.

1. An email arrives: a buyer is interested in your domain, often with a generous figure.
2. You reply. The buyer says their company requires a “certified appraisal” before purchase.
3. They recommend a specific appraisal service. The fee is moderate; reported cases cite amounts around USD 199 to 349.
4. You pay. The appraisal arrives with a high number. The buyer goes silent.

The buyer and the appraiser are the same people. Recent variants arrive through registrar contact forms or spoof registrar names, which makes them look more official.

Test: offer that the buyer orders and pays for any appraisal they want. A real buyer might. A scammer disappears. Real valuation work is covered in domain valuation, and no legitimate sale process makes the seller pay a third party chosen by the buyer.

2. Fake renewal invoices

Letters or emails that look like invoices, with your domain name, an expiry date and a payment slip. Small print reveals that paying means agreeing to transfer the domain to a different company, usually at a much higher price. Some versions simply take the money.

Signs:

• Sender is not the registrar shown in your RDAP record
• Wording like “domain registration notice”, “SEO listing” or “directory entry”
• Bank details in a different country from the sender’s address
• Prices several times higher than normal

Your registrar renews your domain, and you pay it in your account. Nothing else is an invoice.

3. “Someone wants to register your brand in Asia”

An email from a company presenting itself as a registrar or registration authority in China or elsewhere in Asia. It says another company has applied to register your brand in .cn, .asia, .hk or a list of other extensions, and asks whether that company is authorised by you. If not, you can “protect” your brand by registering all the names through them, at inflated prices, often for years in advance.

There is no such approval process. Registries don’t ask existing brand owners before registering names. Ignore the email. If you really want a domain in one of those extensions, register it through your normal registrar.

4. Fake escrow websites

This one targets buyers and does the most damage, because the amounts are larger. A seller offers a domain, often below market price, and insists on a particular escrow service. The link goes to a professional-looking site on a lookalike domain. You pay, and the money and the “seller” vanish.

Check an escrow site’s domain registration date with an RDAP lookup. A site registered a few weeks ago is not the service it claims to be. The legitimate process is in domain escrow.

5. Fake buyer, real payment reversal

Sellers sometimes accept a direct payment by card or payment app, transfer the domain, and then see the payment reversed. The buyer keeps the domain. This isn’t a fake site, just a payment method that allows chargebacks. Use escrow, which holds funds until they’re final.

6. Phishing for logins and auth codes

Emails that look like they’re from your registrar: “your domain will be suspended”, “verify your contact details”, “unusual login”. The link leads to a copy of the registrar’s login page. With your password, the attacker can change DNS, redirect email or start a transfer.

A related trick asks for the auth code directly: “please send your EPP code to complete the verification”. No registrar, buyer or service needs your auth code unless you’re deliberately transferring the domain to them.

7. Domain hijacking through your email

The quiet one. Your registrar account email is on an old domain you let expire. Someone registers that expired domain, receives your password reset emails and takes over your registrar account. From there they can move every domain you hold.

Check which email your registrar account uses. If it’s on a domain you don’t renew or a defunct provider, change it today.

A short defence checklist

• Two-factor authentication on your registrar account
• Account email on a domain you control and renew
• Transfer lock switched on for every domain
• Auto-renew enabled, so expiry reminders from others are easy to dismiss
• Bookmarks for your registrar and any escrow service; never log in via email links
• Payments only through your registrar account or an escrow you opened yourself

Buyers can add one more: verify that the seller actually controls the domain, for example by asking them to place a specific TXT record. More on the purchase process in buying a domain from the owner, and on squatted lookalike domains used for phishing in cybersquatting.

Prices that seem far too low are a red flag on their own. Normal registration costs are public: a .com registration at betadomain costs €14.99 a year, and the price list shows every other extension. If an email tells you your brand needs protecting in more extensions, you can check the names yourself and decide without anyone’s help.