Never log in from a link in a hosting, domain or mailbox warning. Open the provider's site yourself or phone the number on your invoice, and if a password was typed, change it there immediately.

The message that looks routine

The email says your hosting account has been suspended for an unpaid invoice, or that your domain expires tomorrow, or that your mailbox is full and new messages are being held.

It carries the host's logo, copied from its website, and a button asking you to log in and resolve the problem.

The button leads to a page that looks like the host's login screen. Whatever is typed there goes to someone else.

These messages work because they are believable. Hosting accounts do get suspended, domains do expire, and mailboxes do fill up.

The usual stories

The mailbox warning is aimed at everyone, not just the owner. Any member of staff with an address can receive it, and many will click without asking anybody.

How they find you

Many of these messages go to addresses taken from domain registration records. For most .com domains the owner's email is public unless a privacy service is switched on.

Those records also show the expiry date, which lets a fake renewal notice arrive at a believable moment.

Mailbox warnings need no research at all. They are sent to every address at a domain, often with the domain's name inserted to look official.

Signs worth checking

No single sign proves a message is fake, but several together nearly always mean it is.

The sender's address does not match the host's domain, or matches it with one letter changed. The greeting is generic. The deadline is a few hours away.

On a computer, resting the pointer over the button shows where it really leads. On a phone, pressing and holding the link shows the address without opening it.

Gmail now shows a question mark in place of the sender's picture when it cannot confirm who sent a message. On anything about passwords, that deserves a second look.

The login page's address is the final check. A host's login lives on the host's own domain, not on a string of unrelated words.

Check directly instead

The safe habit makes the email irrelevant. Never use the link; go to the provider by a route you already trust.

Type the host's address yourself or use a bookmark, log in, and look. A real suspension or overdue invoice will be visible in the account.

Or phone the support number on your last invoice or contract, not one from the message.

It helps to know your providers before an email arrives. Many businesses are unsure whether the host, the domain registrar and the email provider are one company or three.

A worked example

A packaging supplier with a warehouse and a small office sells boxes, mailers and stretch wrap to local manufacturers and online shops. The office manager pays the bills, including the hosting.

On a busy Monday she received an email saying the hosting account would be suspended within a day over a failed payment. The logo and colours matched the real host's.

She clicked and typed the control panel username and password. The page then showed an error, and she assumed the system was busy.

Two days later customers began replying to emails the company had not sent. Someone had used the control panel to create a new mailbox on the company's domain and send spam from it.

Within days the domain appeared on spam blocklists, and the company's real quotes and invoices began landing in customers' junk folders.

The cleanup took most of a week. The password was changed from the host's real site, the extra mailbox removed, the host asked to check its logs, and delisting requests sent to each blocklist.

The office now checks every billing message by logging in from a bookmark, whatever the email says.

If a password has already been typed

Speed matters more than embarrassment. The sooner the password changes, the less time anyone has to use it.

Change it from the provider's real site, then anywhere else the same password was used. Reused passwords turn one mistake into several.

Tell the host. It can see logins from unfamiliar places, recent changes to the account and mail sent from it.

Then look for what an intruder leaves behind: new email accounts, new FTP users, changed DNS settings, and forwarding rules or filters in the mailbox itself.

Two-step verification where offered

Some hosts and registrars now offer two-step verification, so a login needs the password plus a one-time code from the owner's phone.

A phishing page that captures only a password is then far less useful. Turn it on for the hosting account, the registrar and email wherever it is available, and keep the recovery phone number current.

Tell everyone with a mailbox

The owner is rarely the only target, and a two-minute conversation with staff is worth more than any filter.

The message is short: a warning about an account is checked by logging in directly, never through the link, and nobody is blamed for asking.

A staff member who forwards a doubtful message and gets thanked will do it again.

The counter-case

Some warnings are genuine. Hosts do suspend accounts for unpaid bills, and registrars do send renewal reminders.

A business whose web company looks after hosting and domain renewals, and calls before anything lapses, will see fewer real surprises and can treat most of these emails with suspicion from the start.

None of that changes the habit. Treat every account warning as a reason to log in directly, never as a link to follow.

Before the next fake notice

  1. List your host, registrar and email provider.
  2. Bookmark each login page on the office computers.
  3. Save each support number from a real invoice.
  4. Enable two-step verification on every account that offers it.
  5. Turn on domain privacy if your registration is public.
  6. Tell staff to check warnings by logging in directly.
  7. Agree who to call if a password is typed.

Step two is the one that removes the temptation. When the real login page is one click away in a bookmark, nobody needs the link in an email.

What to look for in the mailbox afterwards is covered in forwarding rules set up by someone else.

Frequently asked questions

What do fake hosting emails usually claim?

That the hosting account is suspended, the domain is expiring, the mailbox is full, a password is expiring, or a sign-in needs confirming. Each links to a fake login page.

How do they know my domain?

Many use the public registration records for domains, which often show the owner's email and the expiry date. Mailbox warnings are simply sent to every address at a domain.

How can I tell a message is fake?

Look at the sender's address, where the link really leads, the deadline and the login page's address. Several warning signs together nearly always mean the message is fake.

What is the safest way to check?

Ignore the link. Type the provider's address yourself or use a bookmark and log in, or phone the support number from a real invoice.

What if I already typed my password?

Change it immediately from the real site, and anywhere else it was used. Tell the host, then check for new mailboxes, FTP users, DNS changes and forwarding rules.

Does two-step verification help?

Yes. Where hosts, registrars and email providers offer it, a stolen password alone is far less useful, because a code from your phone is also needed.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure who hosts your website?

Send us your domain. We will work out who your providers are and where each login belongs.

Start a Conversation