Scammers are getting more creative with phishing attempts, and the latest wave of fake ICANN emails is a perfect example. These messages claim that you must “verify your email within 48 hours” or risk losing DNS access to your domain name. It looks urgent. It sounds official. It uses ICANN’s name. But it’s completely fake.
What This Scam Looks Like
The email mimics an “ICANN Email Verification Required” message, complete with a fake warning about suspended DNS services if you fail to act. It includes your domain name, your supposed registrant email, and a big button urging you to “Verify Your Email Now.”
The problem? ICANN doesn’t send emails like this. ICANN does not contact domain owners directly about verification deadlines, DNS suspension, or account login issues. That type of communication always comes from your domain registrar, not ICANN.
How I Knew This Email Was Fake
In my case, the giveaway was immediate. The scammers sent the message to an email address I never use for any services or logins. It’s a public-facing address that exists purely as an initial contact point—essentially an inbox for general inquiries. There are no domain accounts, registrar accounts, or hosting accounts attached to it. So anything other than a typical “contact us” message is automatically suspicious.
If someone emails that address pretending to be a registrar, a bank, or a service provider, it is 100 percent phishing or spam. That’s why I always recommend using separate email addresses for public-facing contact forms and private logins. Compartmentalizing your email addresses makes it much easier to spot scams.
The Link Gives Away the Scam
One of the fastest ways to expose a phishing attempt is to hover over the link. In this case, the verification button points to a GoogleAPIs Firebase URL—not ICANN, not your domain registrar, and not anything remotely official. Scammers often use these temporary hosting services to store malicious pages designed to steal your login credentials.
If I had clicked, the page would almost certainly have asked me to “log in” to my registrar account. That is exactly how attackers gain access to domain names and transfer them away.
Why ICANN Would Never Send This
ICANN has no role in managing your individual DNS settings or verifying your email address. Email verification notices come from your domain registrar, and those notices will always link back to the registrar’s official website.
Furthermore, ICANN does not threaten DNS suspension through direct email communication. Registrars may follow ICANN policies regarding invalid email addresses, but ICANN itself does not email domain owners demanding action.
How to Protect Yourself from These Scams
- Use a dedicated email address for domain registrar logins and keep it private.
- Use a separate public-facing address for website contact pages and business inquiries.
- Hover over links before you click anything—especially in emails claiming urgency.
- Log in to your registrar from a bookmark or by typing the URL yourself.
- Enable two-factor authentication on your accounts whenever possible.
If you receive an email that seems suspicious, don’t click any links and don’t reply. Log in to your registrar directly and check for any notifications there. If nothing appears in your account dashboard, it’s almost certainly a phishing attempt.
Scammers know domain names are valuable, and they continue to create increasingly convincing emails to trick website owners into revealing their login credentials. This fake ICANN verification message is just the latest attempt. Stay alert, separate your contact emails from your login emails, and always verify the legitimacy of any message claiming urgent action is required for your domain.