Scammers regularly send fake emails that pretend to come from your web host, domain registrar or Microsoft 365, hoping you'll hand over a password or card details. Here's how to spot them, what Host Dada will and won't ever ask you for, and what to do if you've already clicked.
Common fake emails
- "Your domain is about to expire / will be suspended", with a payment link. Often sent by companies that copied your details from public domain records.
- "Your mailbox is full" or "Messages are on hold", asking you to sign in to release them.
- "Your password expires today", with a "Keep same password" button.
- "Payment failed, update your card", linking to a page that looks like a billing portal.
- "Domain registration / SEO listing invoice" from a company you've never used, for a "search engine submission" service.
How to spot a fake
| Check | What to look for |
|---|---|
| The link | Hover over (or long-press) the button before clicking. Genuine Host Dada billing and account links go to my.hostdada.co.uk. Control Panel links go to cp.hostdada.uk, and webmail to webmail.hostdada.uk. Look-alikes such as hostdada-billing.com or my.hostdada.co.uk.secure-login.net are fake. |
| The sender | The display name can say anything. Check the actual address after it, but remember that addresses can be forged too, so the link matters more. |
| Urgency | "Within 24 hours", "final notice", "account will be deleted": pressure is a classic scam tactic. |
| Generic greeting | "Dear user" or "Dear customer" rather than your name. |
| What it asks for | Passwords, card numbers or one-time codes typed into a page you reached from an email. |
What Host Dada will never do
- Ask for your password, two-factor code or full card number by email, text or phone.
- Send you a link to "verify" or "unlock" your mailbox.
- Ask you to pay by bank transfer to a new account, gift cards or cryptocurrency.
Invoices from Host Dada always appear in your Client Area too. If you're unsure about an email, don't click anything in it. Instead, type my.hostdada.co.uk into your browser yourself and check under Billing or Domains. If it isn't there, it isn't from us.
I've already clicked or entered my details
- Change the password straight away, from a fresh browser tab rather than the link in the email. That might be your Client Area, your email account (see Change or reset an email password) or your Microsoft 365 account (see Reset a user's password). If you use the same password elsewhere, change it there too.
- Turn on two-factor authentication. See Two-factor authentication for your Client Area and Set up multi-factor authentication for Microsoft 365.
- Check your mailbox for new rules or forwarding that you didn't create. Attackers often add a rule to forward or hide email.
- If you entered card details, call your bank using the number on the back of your card.
- Tell us. Open a ticket and we'll check your account for unusual logins or sending.
Report it
In the UK, forward suspicious emails to the National Cyber Security Centre's Suspicious Email Reporting Service at report@phishing.gov.uk. You can also mark the message as phishing or junk in your email program, which helps train its filters.
Troubleshooting
A real-looking email came from my own address
Sender addresses are easy to fake. If the message didn't appear in your Sent folder, your account probably wasn't used. Setting up SPF, DKIM and DMARC makes forging your domain harder. See SPF, DKIM and DMARC explained.
I'm getting a lot of these emails
Review your junk mail settings. See Manage spam filtering and junk mail.
Last reviewed: October 2026
