Translated with AI from the Russian original.
F6 specialists (formerly F.A.C.C.T., and Group-IB in Russia) have registered a new wave of fraudulent attacks on domain name owners whose registration period is coming to an end. The attackers send emails on behalf of the registrar about the need to pay for services and a link to pay through a popular payment system.
According to F6, the attack is being carried out on clients of one of the popular Russian registrars. Attackers use Whois services to obtain information about domains whose registration expires in the near future.
In open sources, fraudsters find contacts to communicate with domain name administrators and send a letter on behalf of the real registrar about the need to pay for services to extend the domain name registration. The letter contains a QR code for quick payment of services in the amount of 2190 rubles through a popular payment system. However, the payment does not go to the registrar, but as a transfer to a mobile phone number.
For the new wave of attacks, in the period from March to July 2025, fraudsters registered at least 6 domains in the .ru, .online and .org zones, which contain the registrar's brand in various combinations with the words "payments", "domainpay", "paydomain" and "payonlinehost". At the same time, the attackers mask their resources: the payment link is only available on a specific page, and when you try to go to the main page of the phishing resource, you are redirected to the official website of the registrar. F6 emphasized:
Potentially, hundreds of thousands of website owners may be among the recipients of such phishing emails. According to the statistics service, more than 15 thousand domains are renewed daily in the .ru zone alone.
