Fake domain registrar claiming the target's domain expires today or within hours and will be released to the public or acquired by competitors unless renewed immediately — domain-slamming urgency attack; real registrars send expiry notices on a predictable calendar, not same-day-expiry cold emails with competitor-acquisition threats.

Fake domain registrar or "domain authority" (impersonating GoDaddy, Namecheap, Cloudflare, Network Solutions, or generic "Domain Services") claiming the target's domain name expires today or within hours and that failure to renew immediately will result in the domain being released to the public or acquired by competitors — same-day-expiry domain-slamming attack. Real domain expiry notices from legitimate registrars arrive on a predictable renewal calendar (typically 30, 15, 7, and 1 day before expiry) from the actual registrar where the domain was registered, verifiable via WHOIS; cold emails claiming "your domain expires TODAY — renew in the next few hours or competitors will acquire it permanently" are domain-slamming, registrar-transfer fraud, or credential-harvest attacks. This variant uses extreme same-day / hours-remaining / competitor-acquisition urgency framing. Distinct from domain-registrar-renewal-phish (batch 14 — 48-hour deadline framing) — this targets the same-day expiry / hours remaining / competitor acquisition / renew immediately pretext. Detection: domain expires today/hours remaining + renew immediately + competitors will acquire vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R29; ICANN domain slamming policy; FTC domain name scam advisory 2025; CISA domain urgency phishing patterns.