Phishing Emails That Target Website Owners
Owning a domain puts you in databases that scammers buy. The messages that follow are tailored, plausible, and designed to make you act before you think. Here are the ones we see most, and the tell in each.
1. Domain renewal or expiration notices
An invoice-looking email says your domain expires in days and must be renewed immediately, sometimes at three times market rate, sometimes for a service you never bought. The tell: it is not from your registrar. Never renew from an email link. Log into your registrar directly and look at the actual expiry date.
2. "Search engine submission" and SEO listing fees
Claims that your listing will be removed from search results unless you pay. Nobody charges to be in a search index. Delete.
3. Copyright infringement threats
An email claiming you used their client's photo, with a link to "see the evidence." The link delivers malware or a credential-harvesting page. Real notices arrive through your host or a legal channel and identify the specific image and page. If you are unsure, find the image yourself rather than clicking anything.
4. Forged host or platform alerts
"Your account has been suspended," "your certificate failed to renew," "unusual login detected," with a login button. The page looks exactly like your control panel. The tell: hover the link and read the actual domain, or better, ignore the email entirely and navigate to your host by typing the address you already know.
5. The invoice from a vendor you use
The most effective one. It references a real service, uses the right logo, and changes the payment details. Verify any change to banking details by phone, using a number you already have, not one in the email.
The habits that defeat all five
- Never act from a link in an unexpected email; navigate to the service yourself.
- Two-factor authentication on your registrar, host, email, and website admin.
- A password manager, so a fake login page fails to autofill, which is a useful warning signal.
- One person authorized to approve website and domain spending, so "urgent invoices" have a single place to land.
