Fishing email

• 

  macgaffyfashion · Member · Aug 29, 2018 at 8:29 pm

  • Copy link
  • Add topic to favorites

  Hello,

  Today I recieved an email that said I had to upgrade my WordPress database. When I clicked the link in the email, I went from my email to a website called leovanuden.nl and then it redirected to northdevonanglingnews.co.uk where I had to fill in my credentials in a WordPress like environment. Also the sender wasn’t WP but the email address was (email visible only to moderators and staff).

  Does someone know what this is?

  The blog I need help with is: (visible only to logged in users)

• 

  kokkieh · Staff · Aug 30, 2018 at 10:10 am

  • Copy link

  Hi there,

  Also the sender wasn’t WP but the email address was (email visible only to moderators and staff).

  Why are you clicking on links coming from an email address you don’t recognise? That alone could have infected your computer with malware, so consider yourself lucky that it only took you to a phishing site. To be safe I’d still recommend you run a full malware scan on your computer immediately.

  It does indeed sound like someone is trying to get your credentials for self-hosted WordPress website, but we have no way of telling you who it is that’s doing this. Your best option is to contact the domain provider for the ref.com domain, or the domains you were redirected to when you clicked the link, or else check the email headers and try to figure out the email provider that was used to send the email to you in the first place, and report this directly to those providers so they can take action against the owner(s) of the accounts involved.

  But we here at WordPress.com have no control over the email address, the sites you were taken to, or even over your site, as it’s using the open source WordPress software rather than WordPress.com, so we’re not able to help you in this forum.

  If you did fill in your credentials on the site you were taken to, please update your admin password on your site immediately, and activate Jetpack’s security features if they’re not already active, and in future don’t even open emails coming from unknown addresses, never mind clicking links in them.