Anyone with a website and an email address on their domain gets, sooner or later, emails that seem to come from their host, their registrar or the “mailbox administrator”. They have a single goal: to get you to type your password or card details on a fake page. They look better and better, written in flawless language, with a logo and your name.
What you'll achieve
- recognize a fake email in a few seconds;
- know which addresses you actually log in to at NBT Host;
- know what to do if you have already clicked the link or typed your password.
The most common fake messages
- “Your mailbox is full / will be deactivated / needs to be verified.” With a “Verify now” button leading to a page that asks for your password.
- “Your domain expires today” or “final renewal notice”. From companies you have never heard of, with an invoice attached. Some actually offer you “search engine registration” or another service, written up as an invoice.
- “Your hosting payment failed, update your card.” With a link to a fake payment page.
- “Someone wants to register your name in China (or another country).” It pressures you to buy dozens of extensions “before they do”.
- “You have a voice message / a shared document.” The link asks you to “sign in with your work email”.
How to recognize them
- Look at the sender's address, not the name. The display name can be anything (“NBT Host Support”); the real address appears when you click the name. Our emails come from
@nbt-host.comor@nbt.solutionsaddresses. - Hover over the link without clicking. The address appears in the bottom corner of the window. On a phone, press and hold the link. If the domain isn't one of those in the table below, don't go there.
- Urgency is the main warning sign. “Within 24 hours”, “today”, “final notice” are designed to keep you from checking.
- Unexpected attachments:
.zip,.html,.exe, documents that ask you to “enable content”.
The addresses you actually log in to
| What | Address |
|---|---|
| NBT Account (services, invoices, card) | https://nbt-host.com/cont |
| Enhance, the hosting panel | https://server.nbt-host.com |
| Webmail | https://mail.nbt-host.com |
| Card payments and the invoice portal | Stripe pages, on the stripe.com domain |
The safest way is not to log in from the link in the email, but to type the address yourself or open it from your browser bookmarks.
What we never do:
- we never ask for your password by email, WhatsApp or phone;
- we never ask for your card details by email: you only change your card from your NBT Account, on the Stripe page (see How to change the card you pay with);
- we never close your mailbox because it “is full”: when it fills up, new messages stop coming in, and you can see the space in Enhance (see How much space you use and what takes it up).
Steps — if you have already clicked
A. You opened the link, but didn't type anything
- Close the page.
- If a file was downloaded, don't open it; delete it.
- Run a scan with your computer's antivirus.
B. You typed your password on the fake page
- Change the password immediately for that account, from the real address (the table above). For an email address, from Enhance, under “Emails”; for Enhance, from the account menu (see Your Enhance password and two-factor authentication).
- If you used the same password elsewhere, change it there too (see Strong passwords and two-factor authentication, everywhere).
- Check whether the attacker left anything behind: in Webmail, automatic forwarding and auto-replies you didn't set up (see Email forwarding and auto-reply); in Enhance, new users.
- Write to us: we will check whether messages were sent from your address and unblock it, if it was stopped for spam.
C. You typed your card details
- Call your bank immediately and ask them to block the card. The number is on the back of the card and in your banking app.
- Once you have the new card, add it to your NBT Account (see How to change the card you pay with).
Report the message
- In Gmail or Outlook, mark the message as phishing (Report phishing) or as spam. In Webmail, move it to the Spam folder (see Anti-spam filters and the Spam folder).
- If you get a fake message in the name of NBT Host, send it to us as an attachment or as a screenshot showing the sender's address.
- Cybersecurity incidents can also be reported to your national cybersecurity authority; in Romania, the National Cyber Security Directorate (DNSC): https://www.dnsc.ro.
If something doesn't work
- You can't get into your email anymore, the password no longer works. The attacker changed it. Change it yourself from Enhance, under “Emails”: the password set in Enhance replaces theirs.
- You can't get into Enhance either. Use “Forgot your password?” on the login page, or write to us from the phone number or email address used for your order.
- Your customers receive fake emails from your address. Sometimes the sender is only spoofed, without anyone having broken into your account. SPF, DKIM and a strict DMARC policy make this harder (see DMARC step by step: from “monitor only” to real protection).