An email that pretends to be from your domain provider and warns you that “your domain is about to expire” may be a scam designed to steal your credit card information.
A phishing campaign is circulating that impersonates ROMARG, one of Romania’s best-known domain registrars. The message features the provider’s logo, a red “Open the official portal” button, and a reassuring tone, but it leads to a website controlled by attackers.
The signs that give away the scam are visible even without technical knowledge. The sender’s name was intentionally misspelled—“Romrag” instead of “Romarg,” a technique known as typosquatting—and the actual return address belonged to a foreign domain with no connection to the registrar. The button did not link to romarg.ro, but to an obscure domain. The text included “D0MENIU” (with the number zero) and the incomplete phrase “expires in the next two days,” a sign that the message was automatically generated, with some fields left blank.
Domain owners are predictable targets because their addresses are partially public, gathered from WHOIS queries and contact pages. Receiving such an email doesn’t mean your hosting account has been hacked—it just means your address is on a list.
What to do if you receive a similar message: Do not click the link or download any attachments; verify the actual status of the domain by manually logging in to your provider’s website; report the message to DNSC using the unique number 1911 and, if you wish, to the impersonated provider. If you’ve already clicked the link and entered your card information, contact your bank immediately to block the card.
The rule is simple: it doesn't matter what the email says. If you want to check a domain, open your browser yourself, type in your provider's address, and log in to your account.
Sources:
- DNSC | https://dnsc.ro
- ValidSoftware | https://validsoftware.ro/phishing-in-numele-romarg-septembrie-2026-domeniul-tau-este-pe-cale-sa-expire/
This article was generated with AI assistance.