Fake domain and hosting messages: how to spot phishing attempts

A message warning that your domain is expiring or your hosting account will be suspended can feel urgent, especially when your business relies on its website. Phishing attacks exploit that pressure: someone impersonates a provider to obtain passwords, money or account access. You do not have to judge the message by its appearance alone. A safer approach is to check the request through a channel you already trust.

1. What fake domain and hosting messages are trying to achieve

Attackers build their messages around routine website administration: domain renewals, hosting payments, billing updates or verification of the domain holder's details. These requests can arrive by email, text message, messaging app or contact form.

Domain fraud does not always involve an immediate payment. The goal may be to take over the account that controls your domain settings. In other cases, a fake page collects card details or the password for the email account used to recover access.

• Urgent renewal: you are told to pay immediately to avoid losing your domain.
• Fake invoices: a document looks familiar, but the payee or bank account has changed.
• Suspension warning: you are directed to a login page for a supposed account check.
• Transfer confirmation: someone requests an authorisation code for a transfer you did not initiate.

Legitimate providers also send expiry notices and requests to verify details. Urgency alone does not prove fraud, but it is a reason to check carefully before acting.

2. Visual clues help, but they do not prove authenticity

Awkward wording, a blurry logo or a generic greeting may raise suspicion. However, a polished message can still be fraudulent. Company names, logos and invoice layouts are easy to copy, and your domain name may be available from public sources.

The sender and the link destination

Check the sender's full email address, not just the display name. A different reply-to address or a domain resembling the official one deserves attention. Even an apparently correct address is not a guarantee: a genuine mailbox may have been compromised, and some displayed information can be forged.

On a computer, you can usually inspect a link's destination without opening it by hovering over it. On a phone, the available preview depends on the app; if you cannot inspect it safely, leave the link alone. A provider's name somewhere in a long address does not mean the page belongs to that provider.

A padlock does not identify the page operator

HTTPS indicates an encrypted connection to the website you are visiting, not that the website is legitimate. A phishing page can use HTTPS too. Likewise, a login page that looks identical to the one you normally use does not establish who operates it.

3. Verify the request independently before paying

Independent verification means stepping outside the route offered by the message. Do not use the link, telephone number or contact details in a suspicious notification to ask whether it is genuine.

1. Open your customer account separately. Use a verified bookmark or type the provider's known address yourself. Avoid sponsored search results when looking for the login page.
2. Look for the request in your account. Compare the service, domain, billing period, due date and payment status. If there is no matching record, ask for clarification.
3. Check who manages the service. Your domain and hosting may be with different providers. Consult existing records rather than assuming every website-related message comes from the same company.
4. Confirm payment changes separately. A new payee or changed bank account should be checked through a previously established channel.
5. Ask the provider to confirm. Find its contact details independently on the official website.

If you use GazduireOnline.ro, you can consult the frequently asked questions or submit a request through the contact page, opened separately. Include the subject and when the message arrived, but do not send passwords or authentication codes.

For notices about domain registration or renewal, check the exact domain and the records in your provider account. A sales offer formatted like an invoice does not establish that you owe a payment.

4. What to do if you entered details on a fake page

Do not wait for visible changes to your website. If you submitted a password to a suspicious page, treat it as compromised. Take action from a trusted device, using addresses you access independently.

1. Change the affected account's password. Choose a unique replacement. If you reused the password, change it on other services too, starting with the email account used for account recovery.
2. End active sessions. Use the option to sign out other sessions, where available. Changing a password does not necessarily invalidate every session or every form of access.
3. Review recovery and authentication methods. Check linked addresses, numbers and devices. Enable multi-factor authentication if available. Regenerate recovery codes if you disclosed them.
4. Notify the provider. Explain which account is affected, when it happened and what information you entered. Ask for a review of access and recent changes.
5. Check sensitive settings. Review authorised users, API keys, app passwords, domain holder details, DNS settings and any transfer requests. Check email forwarding rules as well.

If you also entered a temporary authentication code or approved a sign-in notification, the attacker may already have access. Multi-factor authentication helps, but it does not undo an approval you gave to the attacker.

If you supplied card details or made a payment, contact your bank promptly through its official app or established contact details. If you downloaded and ran a suspicious file, stop using that device to sign in and seek technical help. Preserve the message, page address and incident time without circulating active malicious links to colleagues.

5. A straightforward rule for small teams

Decide who checks technical notifications and who approves payments. Require confirmation from a second person for changes to payment recipients or unusual requests. If you work alone, separate reading the message from approving the action, and check your existing records.

• Keep a record of providers, domains and renewal dates.
• Use unique passwords and a password manager. A failure to autofill on a page can be a reason to investigate, not a definitive verdict.
• Do not send passwords, temporary codes or transfer codes in response to unsolicited messages.
• Encourage people to report mistakes quickly, without blame that might delay the response.

6. In practice: pause, check separately, then act

You do not need to recognise every phishing variation by its appearance. A useful account security rule is to avoid signing in or paying directly from unexpected messages. Open your account separately, compare the request with your records and seek confirmation through a known channel. If you have disclosed details, change the affected credentials, review active sessions and notify the provider promptly.