The short answer
A notice from a company you have never used is not your renewal.
Look up your real expiry date, then log in to your registrar yourself. Never pay through the email.
Paid already? Call your bank, and call 997 if you made a transfer.
The four kinds you will see
Most domain scams that reach Malaysian businesses look like one of these. Knowing the shape makes them easy to spot.
The fake expiry email
“Your domain expires in 3 days. Renew now or your website and email will stop.” The button opens a page that looks like a renewal, but only collects your name and card details. Nothing is renewed.
The letter that is really a transfer
It looks like a bill, sometimes on paper, from a company with “Domain Registry” in its name. Paying it moves your domain to them, usually at a much higher yearly price. The small print often says it is not a bill.
The “someone wants your name in China” email
A company says another business is about to register your name as .cn or .asia, and you must buy it first. Unless you sell in China, you do not need these, and real registries do not send these warnings.
The fake “verify your account” email
It says your domain is suspended and asks you to log in. The page steals your registrar password. This is the most harmful kind, because whoever has that login can move your domain or change where your website and email point.
Signs it is not real
One sign alone is not proof. Two or more, and you should stop and check before paying anything.
A company you have never used
Your domain is held by one registrar or reseller. If the notice comes from a different name, it is not your renewal.
An odd sender or link
A Gmail address, a misspelled company name, or a link to a website that is not your registrar’s. Hover over the button on a computer to see where it really goes.
A rush and a tiny price
Countdowns, “today only”, “final notice”, or a price that seems too good. Real renewals give you weeks of warning and a normal price.
A date that does not match
Look up your real expiry date (next section). If the notice gives a different date, it is fake.
A link to pay or log in
Real registrars send reminders too, so a link is not proof of a scam. The safe habit is the same either way: never pay or log in through the email.
Check it in two minutes
You do not need to reply to the notice to find out the truth. Do this instead.
Look up a .com
Search your domain at lookup.icann.org. You will see the registrar that holds it and the real expiry date.
Look up a .com.my
Search it on MYNIC’s WHOIS at mynic.my. It shows the reseller that holds the domain and when it expires.
Open your registrar yourself
Type the registrar’s address or use your bookmark, then log in. Check the expiry date and whether auto renew is on. If a renewal is really due, pay it there.
Ask whoever looks after your website
If your designer or host manages the domain, send them a photo of the notice on WhatsApp. A real renewal is something they should already know about.
If you already paid or clicked
Act quickly. The sooner you start, the more you can stop.
Paid by card
Call your bank now and ask them to block the card. Turn on transaction alerts and watch for small test charges over the next few weeks.
Paid by online transfer
Call the National Scam Response Centre on 997 straight away, then your bank. Speed matters, because money can sometimes still be held in the first hours.
Typed in your registrar password
Go to the real registrar site and change the password. Turn on two step login. Check that the contact email and nameservers have not been changed.
Your domain is moving away
Contact your registrar at once and tell them you did not mean to approve a transfer. Acting before it completes gives you the best chance of stopping it.
Report it
Forward phishing emails to Cyber999 at mycert.org.my. You can check a bank account number someone asked you to pay on Semak Mule at semakmule.rmp.gov.my.
Stop the next one
Ten minutes of setup makes most of these notices harmless.
Auto renew on, two years at a time
Then a real renewal never surprises you, and any “urgent” notice is easy to ignore.
Transfer lock on
Most registrars have a lock that stops the domain moving without your approval. Make sure it is turned on.
Two step login on the registrar
Even if someone gets your password, they cannot get in without your phone.
Write it down once
Note who holds your domain, the login, and the renewal date. The free website ownership record on this site does it in a few minutes.
One person checks domain mail
Agree who in the business reads domain and hosting notices. Everyone else forwards them to that person, instead of paying.
Quick answers.
01Do real registrars send renewal emails?
Yes. Most send reminders about 30 days and 7 days before expiry. The difference is that a real one matches your registrar and your real date. Either way, renew by logging in yourself, not through the link.
02Is the “Domain Registry” letter against the law?
Many are worded carefully, with small print saying it is a transfer offer and not a bill. Whether or not it is legal, you never need to accept it. Your domain stays where it is if you ignore it.
03Do I need to buy my business name as .cn or .asia?
Only if you trade in China or across Asia under that name and want to protect it. A warning email is not a reason to buy. You can ignore it.
04Who sends the real renewal for a .com.my?
The reseller shown in MYNIC’s WHOIS, or the person who manages the domain for you. If a notice names a different company, check before you pay.
05What if I ignore a real renewal by mistake?
Most domains have a grace period after the expiry date, so you can usually still renew, sometimes with a late fee. Turning on auto renew means this never happens.
06What does CST charge?
Hosting with a .com domain is RM 390 a year, and the domain renewal is included, so you will not get a separate domain bill from CST. Moving a domain into your own name is RM 600 with the moving and rescue service.
Related guides
Guide 02.1 · Domain recovery
Getting your domain back from an old web designer
7 min read
Guide 02 · Hosting & domains
Hosting and domains in Malaysia: .com or .com.my?
8 min read
Guide 02.2 · Business email
Business email on your own domain: Google Workspace, Microsoft 365 or hosting email
8 min read
“He explains things in plain language. No jargon, no upselling. I always know what I am paying for.”