It happens in a flash. You are sorting through your inbox, and a high-urgency notification lands: Your domain name is about to expire in 2 days. It lists your exact domain, a fee, and a convenient “Payment link.”
If you hurry up and click, you aren’t renewing your domain. You are handing your payment details directly to a scammer.
A recent wave of highly targeted phishing emails – posing as automated registry alerts from major platforms like Squarespace – is hitting inbox folders. This isn’t a random coincidence. Ever since Google shut down Google Domains and migrated millions of domain assets over to Squarespace, domain-related phishing campaigns invoking the Squarespace name have skyrocketed. Attackers are taking advantage of the widespread confusion that naturally follows massive platform migrations. Even a few years later.
Let’s break down exactly how this specific scam operates, why it looks convincing, and how to spot the URL trap instantly.
The Scam Email Exposed
The fraudulent email is highly structured to mimic an automated system alert. It typically breaks down like this:
Subject: Your subscription has been expired. (notice the bad use of the English language)
The Alert: No. of Domain(s) under your account expiring in the next 2 days: 1
On expiry, the Domain(s) will be deactivated and subsequently deleted. So please review the Domain(s) below and renew, to ensure normal functioning.
The Data:
- Domain name: xx
- Transaction Date: 29/06/2026 01:13:36 AM
- Transaction Amount: 12,69 EUR
The Trap: We encourage you to contact your bank or credit card company for more information. [ Payment link ]
The Footer: If you have any questions about the processing of your order… Feel free to contact my Payments Department, we will be happy to provide you with appropriate clarifications.
The Anatomy of the Link: Subdomain Hijacking
The most dangerous part of this scam is the hidden destination behind that “Payment link.” In recent variants targeting domain owners, the link points to a URL structured like this:
[https://squarespacesigninusers.motoclubrho.com/]
To a user skimming on a mobile device, the eye instantly jumps to the prefix “squarespacesigninusers” and assumes it’s a legitimate secure page. Here is the technical reality of how that URL actually works:
- The Real Destination: To find out where a link is actually taking you, read the URL from right to left, starting at the very first single forward slash (
/). Look at the last two words separated by a dot immediately to the left of that slash. In our example, that ismotoclubrho.com– a completely unrelated, likely hijacked third-party website. - The Root Domain Rule: No matter how many words or subdomains are crammed onto the front of the web address, the true owner is always determined by the text block directly attached to the final extension. If you see
[squarespace.com.motoclubrho.com/](https://squarespace.com.motoclubrho.com/), the real destination is stillmotoclubrho.com. If your provider’s official name isn’t sitting directly to the left of that final extension, the entire link is a fraud.
The Red Flag Rule: If the main domain name sitting right next to the
.comor.netsuffix isn’t your provider’s official, exact domain, the entire link is a fraud – no matter what words are written at the front of the text string.
Why This Phishing Attempt Tricks Smart People
Scammers have moved past the era of obvious, broken English. This attack works because it leverages specific psychological triggers:
- The Google Migration Confusion: Because millions of domain owners were forcefully transitioned from Google to Squarespace, many people expect unexpected billing friction or account setup loops. Scammers use this platform transition to make a random invoice feel plausible.
- The Urgency Hook: It gives you a strict, artificial 48-hour deadline. Panic forces people to act before they analyze.
- The “Failed Auto-Renew” Angle: Claiming there was a problem with an automatic payment explains why you are receiving an unexpected notice. It subtly shifts your focus to checking your bank card rather than questioning the email itself.
- Use of Public Registration Data: Scammers use automated scripts to scrape public registry drops or WHOIS records. Seeing your actual domain name makes the message feel personalized and authoritative.
Other Red Flags to Watch For
While the layout might look clean, these automated templates always fall apart under close inspection:
- The Mystery “Payments Department”: Notice the sudden, jarring shift in tone at the end of the email: “Feel free to contact my Payments Department, we will be happy…” Corporate systems do not fluctuate between “my” and “we” in automated system logs. It reads like a script written by an individual.
- Regional Discrepancies: If you run a U.S.-based business, receiving a renewal notice explicitly billed in Euros (
12,69 EUR) using European date formatting (29/06/2026) is a massive warning sign that a global phishing network generated the invoice.
How to Protect Your Digital Assets
To completely immunize yourself against domain slamming and billing scams, establish one simple operational rule:
🛑 The Golden Rule of Inbox Security
The email is never a participant in the transaction.
Never click a link inside an email to resolve a billing issue. Instead, open a clean browser tab, type your actual provider’s website URL directly into the address bar, log into your secure dashboard manually, and check your status there.
A Note for UltimateWB Clients
If your domains are managed directly through UltimateWB, you will only receive official domain renewal notices from us. We will never ask you to click a strange external link or process a payment outside of UltimateWB. If you ever receive an email about your domain and you aren’t sure if it’s real, don’t risk your data – just forward it to our support team and we will verify it for you.
Still trying to decide on an available domain name to register? Check multiple domain names at once with the free UltimateWB Domain Name Checker tool.
You can register your domain through UltimateWB, or use any domain registrar that allows custom nameserver updates (note that registrars like Cloudflare restrict this feature).
Whichever you choose, your domain will work seamlessly with the UltimateWB website builder and web hosting.
Learn more about UltimateWB – the fast, secure website builder engineered with clean code and powerful built-in features.