--- title: How to Spot Phishing Emails About Your Site description: Phishing aimed at website owners is specific and convincing. Here is how we tell a fake renewal, host or plugin email from a real one. date: 2026-09-07 updated: 2026-09-07 tags: [security monday, phishing, email] url: "https://drivenhost.com/blog/phishing-emails-site-owners" author: DrivenHost --- Most compromises we clean up did not start with a clever exploit. They started with an ordinary looking email and an owner who was busy. The phishing we see aimed at site owners is specific now. It names your domain, your billing cycle, sometimes a plugin you actually run. This week in the series we want to show you what those messages look like from the server side, and how to check one in about a minute. ## The four messages we see most Fake domain renewal notices are the oldest and still the most effective. ICANN publishes a warning about renewal emails that carry its own branding, and points out something worth remembering: ICANN does not process domain registrations or collect fees from registrants directly. If a renewal notice does not come from the company you actually pay, it is not a renewal notice. Suspension threats are the second kind. "Your account has been suspended for abuse, click here to review." A real suspension is usually visible in the account itself when you go and look. Panic is the whole mechanism here. Third, fake plugin and security patches. These arrive with a zip attached or a download link and instructions to upload it through the dashboard. WordPress updates do not work that way. Plugin updates come through your admin screen or from the developer's own site, never as an email attachment, and anything you upload by hand runs with the same privileges as the rest of your site. Fourth, copyright or legal complaints with an attached document listing the "infringing" files. The attachment is the payload. ## Verify somewhere other than the email A display name costs nothing to fake, so reading who a message claims to be from tells you very little. Hovering over the link is better, though on a phone that is awkward and the real destination often gets cut off. The habit that actually works is simpler. Close the email. Open a new tab, type in the address of your registrar, your host or your site yourself, and log in the way you normally do. If the invoice is real it will be sitting in your billing area. If the suspension is real your account will say so. We would rather a customer check their [hosting account](/hosting) directly and find nothing wrong than click a link and find out later. Phone numbers in the email are part of the email, so look those up separately too. ## The fake login page is the point Nearly every one of these messages exists to put you in front of a login form. The form looks right because it was copied from the real one, character for character, and the domain is close enough to pass a glance: a hyphen added, a word appended, or your real domain sitting in a subdomain position so the actual site is something else. Two things help. First, a password manager will not autofill on a domain it does not recognize, and that hesitation is a signal worth paying attention to instead of pasting the password in manually. Second, two-factor authentication turns a stolen password into a dead end for most attackers. Our walkthrough on [turning on two-factor for cPanel](/blog/kb-two-factor-cpanel-login) takes a few minutes and it is the single change with the best return on this list. Do the same at your registrar, where a stolen login can cost you the domain rather than the site. We wrote about that risk in [keeping your domain from being stolen](/blog/keep-your-domain-from-being-stolen). ## If someone already clicked Assume the password is gone and move quickly. Change it from a device you trust, then log out all other sessions where the software offers that. In WordPress, check the user list for accounts you did not create and for existing accounts whose role quietly became administrator. Then check email, because that is where people forget to look. A stolen mailbox password often shows up as a new forwarding rule or a filter that silently files anything containing the word "invoice" or "password reset". Those rules survive a password change and keep working until you delete them. Look at the forwarders and filters on every mailbox on the domain, not only the one that was phished. Check the contact address on your domain registration too, since changing it is a common first move before a transfer attempt. ## Make phishing less useful to whoever sent it Shared logins are the reason one clicked link becomes everyone's problem. Give each person their own account with the access their job needs, and remove the contractor who finished last spring. Keep billing notices going to an address more than one person watches, so a suspension notice that arrives while someone is on holiday is still seen by a human. If a message is convincing enough that your team argues about it, report it and move on: in Canada, the Anti-Fraud Centre takes reports from businesses. The thing we would most like you to take away is the pause. Nothing in a real renewal, invoice or suspension notice expires in the next ten minutes, whatever the email says. If you get something about your site and you are not sure, send it to us through [support](/support) before you click anything and we will tell you whether it came from us. ## Sources - [Alert on Domain Name Renewal Phishing Scam, ICANN](https://newgtlds.icann.org/en/announcements-and-media/announcement-29sep14-en) - [Information for Domain Name Registrants, ICANN](https://www.icann.org/registrants) - [Frauds targeting businesses, Canadian Anti-Fraud Centre](https://antifraudcentre-centreantifraude.ca/scams-fraudes/frauds-business-fraudes-enterprises-eng.htm)