How to detect a slamming email

If you are the owner of a domain name, there’s a good chance you’ve already been exposed to this slamming campaign: an email exhorting you to quickly renew your domain or update your banking information while threatening the loss of your domain due to an imminent expiration.

Here is an example of one of these deceptive emails, which can be safely disregarded:


Attention: Important Notice , DOMAIN SERVICE NOTICE

Domain Name: EXAMPLE.COM

Complete and return by fax to: 1-716-650-4815





Please ensure that your contact information is correct or make the necessary changes above


As a courtesy to domain name holders, we are sending you this notification for your

business Domain name search engine registration. This letter is to inform you that

it’s time to send in your registration and save. Failure to complete your Domain name

search engine registration by the expiration date may result in cancellation of this

offer making it difficult for your customers to locate you on the web. Privatization

allows the consumer a choice when registering. Search engine subscription includes

domain name search engine submission. You are under no obligation to pay the amounts

stated below unless you accept this offer. Do not discard, this notice is not an invoice

it is a courtesy reminder to register your domain name search engine listing so your

customers can locate you on the web.

This Notice for: WWW.EXAMPLE.COM will expire on FEBRUARY 26,2015 Act today!

Select Term:

[ ] 1 year 02/26/2015 – 02/26/2016 $75.00

[ ] 2 year 02/26/2015 – 02/26/2017 $119.00

[ ] 5 year 02/26/2015 – 02/26/2020 $199.05

[ ] 10 year -Most Recommended- 02/26/2015 – 02/26/2025 $295.00

[ ] Lifetime (NEW!) Limited time offer – Best value! Lifetime $499.00

Payment by Credit Card: Select the term above, then return by fax: 1-716-650-4815

By accepting this offer, you agree not to hold DS liable for any part.

Note that THIS IS NOT A BILL. This is a solicitation. You are under no

obligation to pay the amounts stated unless you accept this offer.

The information in this letter contains confidential and/or legally

privileged information from the notification processing department

of the DS 3501 Jack Northrop Ave. Suite #F9238 Hawthorne, CA 90250 USA,

This information is intended only for the use of the individual(s) named

above. There is no pre-existing relationship between DS and the domain

mentioned above. This notice is not in any part associated with a

continuation of services for domain registration. Search engine

submission is an optional service that you can use as a part of your

website optimization and alone may not increase the traffic to your site.

If you do not wish to receive further updates from DS reply with

Remove to unsubscribe. If you are not the intended recipient, you are

hereby notified that disclosure, copying, distribution or the taking of

any action in reliance on the contents for this letter is strictly prohibited.


How to tell if an email is really from Gandi

Sender email address

Before clicking any links or even opening the email, check the address of the sender. This is no guarantee that the email is legitimate, because it’s easy to spoof emails to

look like they come from another address.

For most TLDs, we warn you 60, 30, 15 and 1 day before the expiration date from the email address support-renew[@]


Recipient email address

If you have our anti-spam protection activated on your account, another thing to check is the receiver email address.  We only send email directly to the address you have on file with us, so if you see the receive email address is the “obfuscated” forwarding address visible in the whois (e.g. G23475397CF426333A39B8A1BF5BD226A-1234567@CONTACT.GANDI.NET, as in the example above), you can know that the email didn’t come from Gandi.


Check messages and domains in your account

You can find copies of all the reminders we send you in the Messages folder in your account, and you can verify the expiration date of your domain from your list of domains. 

By the way, if you are concerned about missing an expiration date, you should know that you can always activate automatic renewal.


Activate or refresh anti-spam

Remember that you can replace your real email address in the whois with an obfuscated forwarding address (see how). Every time you submit your contact information (whether you make any actual changes or not), the “scrambled” forwarding address is regenerated and the old one stops working. If you’re getting multiple emails to the obfuscated whois address, just resubmit your handle’s contact info.

If you have any questions, you can always contact our Customer Care team or ask @gandibar on Twitter.