Emergency - my domain name has been kidnapped!!!

Blog > Domain Names > Domain Management

Allow me to introduce myself; I'm the kind and considerate registrar sending you an email reminder to renew your domain name before it expires. I'm the concerned registrar warning you that your trademark domain name is about to be registered by another company. I'm only trying to help… or am I?

Fraud, scam or aggressive marketing?

Can you ignore these email alerts? Dare you? First the kindly email, then the demand for ransom. Fraud, scam, or aggressive marketing?

As with any good scam there's an element of truth. Your domain name might be about to expire and missing the renewal date is both time consuming and expensive. Someone could be monitoring your domain name with purchase in mind.

The WHOIS database is a veritable mine of information revealing contact information of domain name registrants, it also lists all the domain names nearing their expiration date. It's a valuable tool but can so easily be abused (obtaining contact information for questionable purposes is a violation (section of the Accreditation Agreement (RAA). But you have no choice. When you register a domain name, an ICANN rule states that registrants have to provide accurate contact information. These details are then published on the publicly accessible WHOIS database. However, we have a solution - domain privacy. Enable this feature and your details are hidden and replaced with ours, whilst you remain the legal owner of the domain name.

Scam #1 Domain slamming

Domain slamming, a.k.a. unauthorised transfers or registration scams, is the unlawful transfer of domain names from your existing registrar to a new one. The scam begins with an unethical registrar or reseller sending a ‘domain name expiration/renewal notice’ email warning you, the owner, that the registration of your domain name is about to expire and urging you to renew. By responding to the email you have successfully renewed your domain name but, unwittingly, terminated the existing contract with your current registrar and registered with a new service provider. As a EuroDNS customer, if you think you are being targeted by domain slamming, contact us immediately, sales@eurodns.com.

Always read the small print

The renewal notice will have been cleverly written implying that you're already registered with the registrar sending the email. If you respond to the email without reading the small print you may find, along with a new service provider, your fees have increased, and you have agreed to a long-term registration contract. Worst case scenario, you could lose access to your website and email account, or your domain name may now direct visitors to another website. Do you really want to lose your domain name to these criminals, your revenue, your good reputation, your business?

Protect your domain name

The most effective defence against domain slamming is to treat the ‘renewal notice’ email as junk mail, mark as spam to avoid further correspondence and put it out with the rubbish.

But, I'm going to share some advice that'll prove invaluable should you ever be faced with this scam. Never reveal any of your account details or personal information with an individual/organisation claiming to be in the process of renewing your domain name. At EuroDNS we already have all the relevant information regarding your account and would not need you to provide it again.

If you receive a ‘renewal notice’ email and you're unsure of its validity, contact us for a chat and we'll investigate. But, never ever reply to the dubious email. Doing this may expose you to the rather savage sales methods of unethical registrars with the sole purpose of persuading you to transfer your domain name(s).

Keep up-to-date records of your domain name(s) including renewal dates. This means that if you receive a ‘renewal notice’ email you will be immediately aware of whether it’s genuine or not. If you have several domain names registered with different registrars this may also be the time to consider transferring your whole portfolio to a single registrar. You can then schedule the registration renewals to the same date. It also means you don't have to remember the names of various registrars; more information can be found in this blog post about consolidating your domain names.

If the worst happens and you believe you may have been caught by this scam, contact your current registrar immediately so they can reject/cancel the transfer request; and stop any possible payments. We've got a lot of highly qualified domain name experts who can answer any questions you have.

Finding a solution

The Fake Renewal Notices Drafting Team (FRN-DT) was created by the GNSO Council (Generic Names Supporting Organisation) and is part of ICANN’s fight against domain slamming. The team was tasked with preparing an RFI (request for information) on fake renewal notices from the Registrar Stakeholder Group (RrSG). The Registration Abuse Policies Working Group recommended creation of an Issue Report and the results of the RFI were intended to aid the GNSO in their decision as to whether to create such a document.

The RrSG is endeavouring to find a solution to this problem; a problem that is damaging to both registrants and honest registrars. There was an initial suggestion to amend the Registry and Registrar Agreement (RAA) to allow ICANN to act in the instance of a fake renewal notice, but this idea was swiftly rejected as it would be a near impossible contractual obligation to enforce. Whilst the ICANN compliance department have no power over registrars’ marketing techniques, they will investigate if evidence is produced of fake renewal notice abuse by one of its accredited registrars, and action will be taken if proven.

Scam #2 Fake trademark protection

Although less common than domain slamming, fake trademark protection scams are equally damaging to registrants; and my advice again would be ignore, ignore, ignore.

The scam involves deceitful or fake registrars sending domain name owners an email with the warning that another company is attempting to register several domain names containing the domain owner's trademark. Names that are very similar or the exact same name but with an alternative domain extension. The dodgy registrar announces that it's temporarily suspended the attempts at registration to protect the intellectual property of the domain name owner. It asks for immediate action by the owner to protect the domain names.

The fake trademark protection emails are variations on a theme and all follow the style of the genuine example below; capitalised words replace the original text (my apologies for the appalling grammar, it's a genuine scam email):

“Subject: Brand And Domain Names Registration YOUR DOMAIN NAME (If you are not in charge of this, please forward this to your CEO/President, because this is very urgent. Thanks.)

Dear CEO/President,

We are the department of FAKE REGISTRARS. Here I have something to confirm with you. We formally received an application on June 1st, 2012 that a company claimed "FICTITIOUS COMPANY" were applying to register "YOUR DOMAIN NAME" as their Net Brand and some YOUR DOMAIN NAME Asian countries top-level domain names.

Now we are handling this registration, and after our initial checking, we found the name were similar to your company's, so we need to check with you whether your company has authorized that company to register these names. If you authorized this, we would finish the registration at once. If you did not authorize, please let us know within 7 workdays, so that we could handle this issue better. After the deadline we will unconditionally finish the registration for "FICTITIOUS COMPANY ". Looking forward to your prompt reply.”

Tempted to respond? Don’t; the scammer will use scare tactics to persuade you to register the similar domain names as protection against trademark infringement.

Domainers are constantly searching for ways to make a profit; unfortunately there are some who are prepared to use unscrupulous methods. They will email the owner of a registered domain name and offer to sell them domain names that match but with different extensions. If the domain name owner agrees, the domainer will buy the names at the market value, mark up the price and sell to his target/victim, making a nice profit in the process. Although this may not be a crime, it's something to be aware of. Seriously, do your research if you're approached by a domainer and you smell a rat.


Fraud, scam or aggressive marketing; these methods are unpleasant and you're in serious danger of losing your domain names and/or large sums of cash. If you get caught by any of these exploitative actions, or if you're approached and unsure of what to do, get in touch and we'll help.

Photo credit

Previous article:
ICANN 46: EuroDNS legal eagle publishes Beijing précis

Related articles: