Keeping your domain safe: fake renewal notices, hijacks and lookalikes

Why a domain is worth stealing

A domain looks like a small thing: a name and a yearly fee. But everything else hangs off it. Whoever controls the domain can point the website somewhere else, and can receive every email sent to it. That includes the password-reset emails for your bank, your accounting software and your social media.

So the threats come in three kinds: someone tricking you into paying them, someone taking control of the name, and someone imitating it. This lesson takes them in that order.

Fake renewal notices

This is the one nearly every business meets eventually. An official-looking letter or email arrives saying your domain is about to expire, with an amount and a way to pay. It isn’t from the company you registered with.

The National Anti-Scam Centre’s Scamwatch describes how it works:

• “The letter has the appearance of an invoice or renewal notice, including common features such as credit card payment logos, a payment option tear off slip and sometimes barcodes.”
• “The letter is not a renewal but is actually selling a new (but very similar looking) domain name (eg .com rather than .com.au).”
• “You pay the invoice without realising that it is not for your current domain.”

The result: you’ve paid for a name you didn’t want, and your real domain hasn’t been renewed at all.

These letters used to be timed from public records. auDA’s WHOIS Policy explains that expiry dates once showed in WHOIS, which “enabled some members of the domain name industry to send unsolicited renewal notices to registrants with whom they did not have a prior business relationship, causing significant levels of customer confusion”. That’s why .au expiry dates are no longer public.

How to tell a real one

Scamwatch’s advice is to “check the details of domain name letters carefully to make sure the business billing you is the one you normally deal with and look for small differences in the name”. In practice:

• Know who your provider is. A genuine renewal comes from the company you registered with. If you’re not sure who that is, look the domain up.
• Read the domain letter by letter. yourname.com is not yourname.com.au.
• Check the date yourself. Sign in to your provider and look at the real expiry date. If it’s months away, the notice is noise.
• Tell whoever pays the bills. Scamwatch again: “Anyone who opens your mail should be on the lookout for domain name letters and flag them for review.”

Read our guide to domain renewal scams in Australia for more on these letters.

Phishing: “your domain has been suspended”

The email version goes after your login instead of your money. It says the domain is suspended, expiring today or needs verifying, with a button. The button leads to a copy of a sign-in page, and whatever you type goes to the scammer.

The defence is a habit: don’t follow a link in a message you weren’t expecting. Open your provider’s site yourself, sign in there, and see whether anything is actually wrong. It almost never is.

Hijacking: losing control of the name

A hijacker doesn’t break into the registry. They get into something of yours: the account the domain is managed from, or the email inbox that transfer codes and password resets are sent to. From there they can move the domain to another registrar, or leave it where it is and change its nameservers.

Three locks stop almost all of it.

• Two-factor sign-in means a stolen password isn’t enough. A passkey goes further: there’s no password to steal, and it only works on the genuine site, so a fake sign-in page gets nothing.
• The transfer lock shows on a public lookup as clientTransferProhibited. ICANN describes it as telling “your domain’s registry to reject requests to transfer the domain from your current registrar to another”.
• The registrant inbox matters because codes are sent to it. If a former staff member or an old web designer controls that address, they effectively control the domain too.

Also read the notification emails your provider sends. A message saying your nameservers or contact details were changed, when you changed nothing, is the earliest warning you’ll get.

Lookalike domains

The third kind of attack doesn’t touch your domain at all. Someone registers a name close to yours, such as a different ending, a hyphen, a doubled letter or rn in place of m, and uses it to imitate you. The usual aim is an email to one of your customers with “updated bank details” on an invoice.

You can’t register every variation, and you don’t need to. What helps:

• Hold the obvious pair. If you trade on yourname.com.au, holding yourname.au as well closes the nearest gap. Forward it to your main site. Not sure it’s worth it? Read our guide to whether you need the .au as well.
• Set up DMARC. It stops forgeries of your exact domain, which pushes scammers onto lookalikes that are easier to spot.
• Tell customers how you work. A line on your invoices saying you’ll never change bank details by email does more than any technical measure.

A padlock proves nothing here. Lookalike sites have certificates too.

The risks closer to home

Most lost domains aren’t stolen. They slip away.

• Registered in someone else’s name. If your web designer or a staff member registered the domain under their own details, it’s theirs on paper. Check who the registrant is.
• One person holds the only login. When they leave, so does your access.
• Nobody renews it. See how to never lose a domain to expiry.

A ten-minute check-up

If something looks wrong, or you’ve already paid a notice you now doubt, contact your real provider first. Scams can be reported to Scamwatch. Our guide to domain renewal scams in Australia has more on what to do next.

Terms in this lesson

Fake renewal notice

A letter or email dressed up as a renewal invoice from a company you’ve never dealt with.

Phishing

A message that pretends to be from a company you trust, to get you to sign in on a fake page or pay a fake invoice.

Domain hijacking

Someone taking control of a domain they have no right to, usually by getting into the account it’s managed from and then transferring it away or changing its nameservers.

Registrar lock

A setting that blocks a domain from being transferred to another registrar until you switch it off.

Two-factor authentication

A second proof at sign-in, usually a six-digit code from an app on your phone.

Passkey

A way of signing in with your device’s fingerprint, face or PIN, with no password to steal or reuse.

Typosquatting

Registering a name that looks like someone else’s, such as a misspelling or a different ending, to catch their visitors or imitate them by email.

Registrant

The person or organisation a domain is registered to.

DMARC

A TXT record at _dmarc that tells receiving mail servers what to do with email that fails the SPF and DKIM checks, and where to send reports.

Every term, in full, is in the glossary.

Sources

All read on 2 October 2026.

• Beware of unsolicited domain name registration offers (Scamwatch, National Anti-Scam Centre): how fake renewal notices work and how to protect yourself.
• WHOIS Policy (2025-11) (auDA): why expiry dates were removed from .au WHOIS.
• EPP Status Codes (ICANN): what the transfer lock status does.