Website Access Scam Email

Watch out for this email scam

We often try to keep people in the know about website security scams.  This is another one that popped up for us.  We received an email (filtered to our junk mail) that looked like this:

This email was sent to us for our small horse ranch.  We want to bring to your attention a couple of points in this message.

1. First, WordPress periodically asks whether the primary account’s email address is accurate.  However, the request is triggered only when you initiate a login to your account, typically by visiting www.yourwebsite.com/wp-admin.  Your WordPress website will not attempt to solicit a request like this via email.
2. Secondly, take notice of the email address in the From: field.  It is from an email address not associated with our website domain, anchoragehorseboarding.com.  All messages sent to you from your WordPress website are sent to you via your domain and administrator email address for your site.
3. Lastly, all emails sent to you from your WordPress website use the name you enter in your WordPress customizer settings.  Take a look at this message that is generated from our website below. This message is authentically sent from our website.  It shows the site name, and the email address in the From: field is our actual email address.

We, of course, investigated the link in the “Verify Email” button of this message.  Take a look at what we see next:

Looking at the URL in the address bar, you can see the link points to a domain not associated with our website.  At this point, we discontinued our investigation.  The web page is carefully crafted so that the login credentials area looks just like your standard WordPress login screen.  Logging in to our website on this page would have granted third-party access.  Malicious website actors use this type of scam all the time in an attempt to dupe unsuspecting website owner to give them access to their sites.

Always use caution!

Email scams that attempt to gain access to your website take many forms.  NEVER open or respond to an email that is not associated with your actual domain and the email address that is set up in your administrator account.  If you ever want an expert set of eyes to review something you think is suspicious and are not sure how to handle, CONTACT US.  We are perfectly happy to help you out.