domain slamming.

The letter arrives by post or email. It carries your actual domain, your actual expiry date, a due date and a payable amount, and it is laid out like an invoice from an organisation whose name sounds administrative and quasi-official. Paying it does renew the domain, technically — at the sender's price, which is usually several times the market rate, and only after transferring the domain to them. The word transfer appears somewhere, in the paragraph nobody reads.

It works because the raw material is free. Domain and expiry data has always been public through WHOIS and RDAP, so the deadline in the letter is real, which is precisely what makes it convincing. It is also aimed carefully: at organisations, the letter reaches whoever processes invoices rather than whoever owns the domain, and that person has no way to know your registrar is not called this. Regulators in several countries have taken action against operators running the scheme, and it keeps reappearing under fresh names.

Recognising it is straightforward once you know the shape. Renewal notices come from the registrar you already pay, and you can verify who that is in your own account rather than from an unsolicited letter. The price will be conspicuously above market. There will be a signature line or a payment that constitutes authorisation. And the sender will not be able to tell you anything about your account that is not already public. If you are unsure, check the domain's real registrar and expiry date with the expiry checker before paying anything.

Immunity is mostly structural. Keep the registrar lock on, never release the auth code except to a registrar you have deliberately chosen, and consider WHOIS privacy to reduce the harvesting of your postal address in the first place. Most usefully, get renewal reminders from a source you picked: if you already know exactly when every domain renews and what it should cost, an invoice claiming otherwise is obviously wrong. That is what expiry monitoring is for.