I just received a letter from the Domain Registry in my mailbox (paper letter) that I must renew the letter before the expiry date and the rates are much higher than what I got from Cloudflare at the time of domain transfer. I am not sure if it’s a scam or is it something I am not aware of.
The Address on the letter is;
2900 Warden Avenue
Box # 92090
Toronto, Ontario, M1W 3Y8
tl;dr: This is a marketing campaign and as you mentioned it is widely considered to be a scam.
This is a scheme that has been going on for at least 15 years in Canada. While it isn’t limited to Canada specifically, this particular company targets Canadian domain registrants specifically.
In a past life I ran a small hosting company (also in Canada), before WHOIS privacy was a feature that was officially available, I allowed clients to use my POBOX as their address so for years I got mail for dozens of domains.
Initially they got their information from WHOIS records, and even though your domain might have WHOIS privacy enabled today (Cloudflare is great about this), they likely scrape historical records and/or maintain copies of records themselves, and send a not-invoice-that-looks-like-an-invoice shortly before domain expiry dates.
I have reason to believe that they look for contact information on the website itself too, based on a client receiving one of these at an address that was never published into WHOIS, but I can’t prove where they get their data.
A company I worked with sued one of the companies involved (well over a decade ago) and the result was that they had to add text explaining that this was “a solicitation for new business, and not an invoice”, text that was prominent at first, and got buried in fine print some time later.
It may not technically be a scam in the literal sense as they do actually offer domain registration services and (at least in the past) would attempt to transfer your domain if you do send a cheque. I’m not sure how this would work now as domain transfers require an auth code, but I’m sure they do the bare minimum to avoid criminal charges for fraud.
My opinion is that this is a scam because they appear to be sending an invoice rather than a marketing offer to solicit business.