We've gotten some of these incoming spam messages lately. Even before they ask for a certificate, a good rule of thumb for newcomers is to check the website affiliated with the email address- often it's a forward to a similar but more legit site, and the whois frequently shows registration only a few days old, and in a different country. It's also a giveaway when they just say 'your domain' but not which one in the offer- or offer 60k on a domain without visiting the sales lander to see it says 7k!!