Today I received a phishing email pretending to be from EuroDNS, the domain registrar for @freesewing
The From: address is not what you'd expect, and the link doesn't go where it pretends to go either.
But those are not even visible on nobile UI. What made me immediately suspicious is the threat to delete if no payment is made within 5 days.
Because that's not how this works. When a domain expires, it is placed in quarantine, from where you can get it back for a fee.
Be careful out there.