Malicious phishing mails on the way


Currently many domain owners are receiving faked e-mails informing about an alleged suspension of their domain. These mails are looking authentic, because

  • as sender deLink or another, really existing registrars is indicated
  • the e-mail adress of the recipient is correct
  • the personal name is correct
  • the domain really belongs to the recipient

Obviously the data was grabbed from the public domain whois. The content of the e-mail is similar to this:

Dear John Doe,

The Domain Name have been suspended for violation of the deLink GmbH Abuse Policy.

Multiple warnings were sent by deLink GmbH Spam and Abuse Department to give you an opportunity to address the complaints we have received.

We did not receive a reply from you to these email warnings so we then attempted to contact you via telephone.

We had no choice but to suspend your domain name when you did not respond to our attempts to contact you.

Click here and download a copy of complaints we have received.

These e-mails are FAKED.

If you click the proposed link, you will very probably get a trojan onto your device. In case of doubt please forward the e-mail to us, we will analyze it and give you a feedback.

Phishing e-mails addressed to domain owners

Often disturbed customers, who received ominuos e-mails concerning their domains registered with deLink, ask us for advice.

  • someone wants to register my domain and my “Internet Keyword” what shall I do?
  • someone sent an urgent payment reminder for my domain, have I got to pay?

When you receive e-mails of this kind, please be very cautious! Of course deLink will remind you before your domain expires and tell you whether you have to renew it manually or whether it will be renewd automatically (which is the default method). But there are some very typical methods used to drag the money out of the pockets of domain owners.

spam_delinkVery popular: You get an e-mail – allegedly from an internet provider, in most cases from China, but from Hongkong or Switzerland somtimes, too. You are informed that a company, which is totally unknown to you, has requested registration of your domain or your “Internet Keyword”. But it was detected that this request collides with your interest. You should answer asap regading this issue.

What does that mean? First of all the story about an alien company requesting your domain is completely fictional in most cases. And there is no such thing as an “Internet Keyword” which could be taken from your. The intention is to put you under pressure!

What is the purpose? The sender tries to induce you to register additional domains with different endings and – under pressure – pay exorbitant prices and accept incredible conditions. We have witnessed cases where a customer had to pay several thousand US dollars for just three domains. As soon as you have signed an order fax it will be extremely difficult to escape that trap!

What if you do not react? According to our experience – nothing at all. (If you really want to register the domains which were offered, you can do so via your preferred provider – at normal prices and conditions.)


Serach Engine Submission OfferAnother method method suggest that a domain fee has to be paid – urgently. If you look closer you will find that the payment asked for is not for a domain renewal, but for a search engine submission. The letter is just an offer, not an invoice, though it looks very much like a domain renewal invoice.

Very suggestive is a line e.g. WWW.DELINK.INFO will expire on DECEMBER 03,2013 – Act today!

But it is only the search engine offer, which will expire – not your domain!


The new ”Expired Registration Recovery Policy” (ERRP) by the ICANN is intended to support domain owners in regard to domain renewal, deletion and possibly restoration. deLink is obliged to send reminder mails and provide information according to this policy.

Reminder e-mails


From now on domain owners will receive a reminder e-mail about 1 month and about 1 week prior to the renewal date of each domain. These reminder mails will be sent  from or a neutral e-mail address – additionally to the usual reminder e-mails. They will be sent independent from the state of the domain, whether AutoRenew is set or not, or whether a deletion has already been requested or not.

Deleted domains

A domain which has not been renewed will be automatically disconnected after the renewal date. E-mail and the original website will no longer function, instead a website with information about a possible restore will be displayed.

Within 5 days after a domain has been disconnected because of failure to renew, but has not been deleted, a reminder e-mail will be sent which contains information about how to restore the domain. With many TLDs (but not all of them) a restoration after a failure to renew or even after an unintended deletion is possible for several days. For gTLDs (such as .com, .net, .org, .info etc.) – but  not for Sponsored gTLDs – generally a time frame of 30 days is open during which a restoration is possible. Special fees will be charged for restorations, which usually are considerably higher than the yearly fee.


If you have set your domains to AutoRenew at deLink – which we generally recommend – don’t be worried by the ICANN reminder e-mails – your domains will be automatically renewed in time when set to AutoRenew.