Scary Website Emails: Beg Bounties, Fake DMCA Notices and Renewal Scams

An email lands that makes your stomach drop. Someone says they found a serious vulnerability on your website and would like a “bounty”. A “law firm” says you used a copyrighted image and demands payment or a link. A letter says your domain is about to expire and you must renew through them. Your “host” says your account will be suspended in 24 hours unless you log in. “Google Search Console” warns that your site has been removed from search.

Most of these are scams, but not all. Hosts really do suspend accounts, registrars really do send verification emails, and real copyright complaints exist. The skill is not to ignore everything; it is to verify each one through a channel the sender does not control. This guide covers the common types, the tells for each, and how to check it safely. Where legal notices are involved, it is general information, not legal advice.

What is happening

Your domain, contact page and public email addresses are easy to find, and scammers send these messages at scale. Many are generated by automated tools that scan sites for minor issues, scrape contact addresses and fill in a template. The goal is one of four things:

• Money: a “bounty”, a fake invoice, an inflated renewal or a “settlement” payment.
• Your login: a link to a convincing copy of your host, registrar, Google or Microsoft login page.
• Malware: an attachment or download link to “evidence” or “the report”.
• A backlink: a demand that you link to a site to make a complaint go away, which helps that site’s search ranking.

The golden rule for every type below: verify through the real account, not the email. Type the provider’s address into your browser yourself or use your saved bookmark, log in, and look for the same notice. If it is real, it will be there, or the provider’s support team will confirm it through a ticket you opened yourself.

Quick reference: common scary emails

Email says	Usually	Tells	Verify by
“I found a vulnerability on your site, what bounty do you pay?”	Beg bounty	No details until you agree to pay; trivial findings; free webmail sender; template wording.	Check the claim yourself with our tools; look for a real proof of concept.
“DMCA notice: you used our client’s image”	Backlink scam or malware lure	Demands a link or payment; links to download “evidence”; no specific copyrighted work identified.	Check whether your host received a notice; check the image’s source and license.
“Domain expiration notice” letter or email with an invoice	Renewal or listing scam	Company is not your registrar; small print says it is not a bill or is a “listing” service.	Log in to your actual registrar and check the expiry date.
“Someone is registering your brand in another country”	Domain registration upsell scam	Urgent deadline; offers to register many extensions for you.	Ignore unless you already planned to register those domains.
“Your hosting account will be suspended”	Phishing, sometimes real	Link to a login page not on your host’s domain; generic greeting; wrong host.	Log in to the host panel yourself; check open tickets and billing.
“Google Search Console: your site was removed” or “verify ownership”	Phishing, sometimes real	Link is not to search.google.com; asks you to add a user or download a file.	Open Search Console yourself and check the Messages panel.
“Verify your domain contact details or it will be suspended”	Often real, sometimes phishing	Sender is not your registrar; link goes to an unrelated domain.	Log in to your registrar and look for a pending verification.
“We hacked your site, pay or we publish your data”	Extortion spam, usually bluffing	No proof specific to your site; cryptocurrency demand; deadline.	Check your site and logs for real signs of compromise; do not pay.
“Your site is losing traffic, here is a free SEO audit”	Sales spam	Generic findings; your site name pasted into a template.	Check Search Console yourself.
“Accessibility complaint” or demand letter	Can be real legal correspondence	Real ones name a law firm or court you can look up independently.	Follow the accessibility complaint guide and get legal advice.

Beg bounties: “I found a vulnerability, what is the reward?”

The security company Sophos coined the term “beg bounty” for unsolicited emails from people who run automated scanners against a website, paste the results into a template and ask for payment. The “vulnerabilities” are usually minor configuration findings: a missing security header, an SPF or DMARC record that is not strict, a visible WordPress version number, clickjacking protection not set, or “your email can be spoofed”. Sophos found that paying for one finding can lead to further demands for more.

How to tell

• They will not describe the issue until you agree to pay, or they describe it in generic terms that could apply to any site.
• The sender uses a free webmail address and calls themselves a “security researcher” or “ethical hacker” with no organization.
• They ask whether you have a “bug bounty program” and mention a price range.
• The finding is something our security headers checker or email authentication checker shows in seconds.

What to do

• Do not pay and do not agree to terms. You owe nothing for an unsolicited scan.
• Check the claim yourself. Run your site through the headers and email checkers, and update WordPress, plugins and themes. If a real gap shows up, fix it; the security headers and hardening cheat sheet gives safe baseline values, and the sender requirements guide covers SPF, DKIM and DMARC.
• Either ignore it or send a short, polite decline. Our vulnerability report replies template has both a decline and a reply for genuine reports.

When a report is real

Genuine researchers usually give specific details freely: the exact URL, the plugin and version, steps to reproduce, and the impact. They do not demand payment first. If a report names a specific plugin vulnerability, check it against the plugin’s changelog and follow a plugin on your site has a security vulnerability. Thank them, fix it, and tell them when it is done. A security.txt file at /.well-known/security.txt tells researchers how to reach you and whether you offer rewards; the hardening cheat sheet shows the format.

Fake DMCA and copyright notices

Two different scams use copyright threats.

The backlink scam

An email from a “law firm” or “copyright agent” says an image on your site belongs to their client and demands that you either pay or add a link crediting a particular website. The aim is the link, which they sell as SEO. Reporting by journalists has documented these firms using invented lawyers with generated photos, and the “owned” image often turns out to be from a free stock library.

Tells: the remedy is a link rather than removal; the firm cannot be found in an official lawyer directory; the email does not identify the specific copyrighted work clearly or prove ownership; the “client” website is new or unrelated.

The malware lure

A message, often submitted through your own contact form, says a photographer or illustrator found their work on your site and threatens legal action, with a link to “see the images”. Microsoft documented a campaign of exactly this kind in 2021 in which the link led to a page that downloaded malware. Because it arrives through your own form, it can look more trustworthy than ordinary spam.

Tells: a link or attachment you must open to learn which image is involved, a file-sharing or site-builder link rather than a named image URL on your site, and pressure to act today.

How to verify a copyright complaint

• Do not open attachments or download links. A genuine complaint can name the page and image in plain text.
• In the United States, formal DMCA takedown notices for hosted content usually go to your host, which lists a designated agent with the US Copyright Office. If a real notice was filed, your host will normally contact you through your account or support system. Log in and check, or ask your host through a ticket.
• Check where the image came from: your own photo, a stock license you can find in your records, or something a designer added. A reverse image search shows other places it appears.
• If you cannot show you have the right to use an image, replacing it is cheap and quick, whatever you decide about the email.
• Never add a link to make a complaint go away. If you receive a credible legal notice from a firm you can independently verify, talk to a lawyer before responding. Counter-notice rules and deadlines vary by country, so check with a lawyer licensed where you operate.

Domain renewal and “registry” scams

Look-alike renewal notices

A letter or email titled something like “Domain Name Expiration Notice” lists your domain and an expiry date (taken from public records) and asks you to renew. The sender is not your registrar. Paying either does nothing useful or starts a transfer of your domain to the sender at a higher price, a practice often called domain slamming. In the United States the Federal Trade Commission took action against a company over misleading renewal notices of this kind in 2003, and they still circulate.

Search engine submission and listing invoices

A similar message offers “search engine submission”, “SEO listing” or a “domain listing” and is formatted to look like an invoice for your domain. The small print says it is an optional service, not a bill. Search engines do not charge to index sites; you submit a sitemap free in Google Search Console and Bing Webmaster Tools. See new website not showing on Google.

“Someone is registering your name in Asia”

An email from a “registry” or “domain registration center” says a third party has applied to register your brand under a country domain and offers you priority if you act quickly. It is a sales tactic. Register other extensions only if you already wanted them, and only through your own registrar.

How to verify

• Look up your domain in our domain lookup tool. It shows the real registrar and expiry date from RDAP.
• Log in to that registrar directly. If renewal is due, renew there.
• Check your own invoices. A company you have never paid is not your registrar.
• If you are not sure who your registrar is, the domain lifecycle cheat sheet explains what each stage after expiry means, so you know how much time you really have.

Real registrar emails you should not ignore

Registrars accredited by ICANN must send renewal reminders before a generic domain expires, and must verify the registrant’s contact details after registration, transfer or a contact change. If a real verification is not completed in time, the registrar can suspend the domain. So a “verify your contact details” email may be genuine. Check by logging in to the registrar yourself; a real pending verification will show there. Fake verification emails are a known route to domain hijacking.

Fake hosting suspension and account warnings

Phishing emails copy hosting brands closely: “Your account has been suspended”, “Payment failed, service will be terminated”, “Disk quota exceeded, click to upgrade”, “Unusual login detected”. The link leads to a fake login page that captures your hosting password, which gives the attacker your files, databases and email.

• Hover over the link (or press and hold on a phone) to see the real address. A login page on any domain other than your host’s is a scam.
• Check whether the email names your actual host and your actual account or plan. Scammers send hosting warnings to everyone, including people with a different host.
• Log in to the control panel or client area from your bookmark. Real suspensions show in the panel and usually in open support tickets or billing.
• If you typed your password into a fake page, change it at once from the real site, turn on two-factor, and check for new users, email forwarders and files. See admin or client account compromised.

If the suspension is real, it is usually for malware, phishing pages or spam sent from your account. Follow hosting account suspended for malware, phishing or spam.

Fake Google Search Console and Google account notices

Search Console really does email site owners about indexing problems, security issues, manual actions and new owners. Attackers copy those messages to steal Google logins or to trick you into granting a stranger access to your property.

• Open https://search.google.com/search-console yourself and check the Messages panel (the bell icon). Genuine notices also appear there.
• Check Settings, Users and permissions, to see who has access. Remove anyone you do not recognize.
• Be suspicious of any email asking you to add a user, upload a verification file or log in through a link. Google does not need you to do those things to fix a problem.
• If Search Console shows a real security issue, your site may be hacked; start with WordPress site hacked: the first hour and the deceptive site warning guide.

Extortion emails: “we hacked your site”

Bulk emails claim to have hacked your site or database and threaten to publish data, damage your reputation or flood the site with traffic unless you pay in cryptocurrency. Most include no evidence specific to your site. Do not pay or reply. Check your site for real signs of compromise: unknown admin users, unexpected files, redirects, or warnings in Search Console. If you find any, follow the hack recovery guides. If the threat is a traffic flood, see website under a traffic flood or DDoS attack. Report genuine extortion to the police.

How to check any email in five minutes

1. Pause. Urgency is the scammer’s main tool. A real problem will still be real in ten minutes.
2. Do not click. No links, attachments, replies or QR codes until you have verified.
3. Check the sender. Look at the actual address, not the display name. Then look at the full headers: Gmail’s “Show original” shows whether SPF, DKIM and DMARC passed. A pass only proves the email came from that domain, not that the domain is honest, but a fail on a message claiming to be your host is a strong warning.
4. Verify independently. Log in to the real account from a bookmark, or contact the company using details from your own records or their official site.
5. Check the facts. Does the domain, account, plan, expiry date or invoice amount match your records?
6. Decide. If it is fake, delete it or report it as phishing in your mail app. If it is real, deal with it through the real account.

If you clicked a link and entered a password, change that password from the real site immediately, turn on two-factor, and check the account for changes. If you opened an attachment or ran a download, disconnect the computer from the network and have it checked for malware before you log in to anything else from it.

If none of that worked

If you still cannot tell whether a notice is real, ask the provider directly. Open a ticket with your host or registrar through their site and paste the email in plain text, without forwarding links or attachments you have not checked. For legal letters you cannot verify, ask a lawyer. Report phishing to the brand being impersonated (most hosts, registrars and Google have abuse or phishing reporting pages) and, if money was lost, to your bank and the police or national fraud reporting service; your government’s official website names the right one where you are.

Related guides: someone is spoofing your domain, email account hacked and sending spam, and the scary email or notice triage page.