Phishing is when someone sends an email, text or message pretending to be a company you trust, to trick you into giving away passwords, payment details or other private information. Scammers sometimes pretend to be hosting companies, because a hosting account holds a website, email and often money. This article explains how to recognise fake emails that claim to come from MusiHost, how to report them, and what to do if you have already clicked.
The key rule
Never act on an email alone. The "From" address on an email can be faked, so a familiar address does not prove the message is real. If an email says there is a problem with your account, do not use its links. Type account.musihost.com into your browser instead and log in from there. If there really is a problem, you will see it there.
How to spot a fake email
- Check the sender's domain. Genuine MusiHost emails come from addresses ending in @musihost.com. Watch for lookalikes such as musihost-billing.com, musihst.com or musihost.support.
- Look at the greeting. We address you by name. Be wary of "Dear customer" or "Dear user".
- Be suspicious of urgency. Messages that say your account will be deleted today, or that you must act within hours, are designed to make you panic.
- Check where links really go. On a computer, hover over a link without clicking it. On a phone, press and hold the link. Read the web address from right to left up to the first single slash. For us, it should end in musihost.com.
- Notice the quality. Spelling mistakes, odd wording, stretched logos or the wrong colours are all warning signs.
- Be careful with attachments. Do not open a ZIP file, Office document or PDF you were not expecting, even if it looks like an invoice. If in doubt, log in to your client area and check your invoices there.
What we will never do
- Ask for your password, your cPanel password or a two-factor authentication code by email, ticket or message.
- Ask you to install remote-access software on your computer without you contacting us first.
- Ask you to pay through an unfamiliar website, or to send card details by email or ticket.
- Ask you to sign in through a link in an email to "verify" your account.
Domain verification emails
If you register or change the contact details of a .com or .org domain, the domain registry rules mean you may get a genuine email asking you to verify your contact details. These come from the domain registrar, not always from us. If you did not just change or register a domain, or you are not sure, do not click. Open a ticket and ask us.
If you receive a suspicious email
- Do not click, open attachments or reply.
- Forward it to us at billing@musihost.com so we can check it and warn others if needed.
- Report it to the NCSC (the UK's National Cyber Security Centre) by forwarding it to report@phishing.gov.uk. For a scam text message, forward it to 7726.
- Delete it.
If you have already clicked a link or entered details
Do not panic. Acting quickly limits any harm. Work through these steps:
- Change your MusiHost password now. Type account.musihost.com into your browser, log in, and change it. If you cannot log in, use the Forgot password link on the login page.
- Change your cPanel password too, since it is separate from your client area password. Also change the passwords of any email accounts you entered.
- Turn on two-factor authentication in your client area, so a stolen password alone is not enough.
- If you entered card or bank details, contact your bank straight away and tell them. If you lost money, report it to Action Fraud (the UK's fraud reporting service).
- If you downloaded or opened a file, run an antivirus scan on your device, and change any other passwords you reuse.
- Open a support ticket from your client area, so we can check your account for unusual activity.
If you cannot log in
Use the Forgot password link on the login page at account.musihost.com. If you still cannot get in, email billing@musihost.com from the address on your account and tell us what happened.
Things to note
- If you are not sure whether a message is from us, ask. Forward it to billing@musihost.com. We would much rather check than have you take a risk.
- These tips apply to any email, not just ours. Banks, delivery companies and online shops are all copied by scammers.
- Using a different, strong password for each account, and a password manager, limits the damage if one gets stolen.
