WordPress Phishing Scam Sent to Client Emails

• 

  biancafrankdesign2 · Member · Nov 29, 2023 at 11:05 pm

  • Copy link
  • Add topic to favorites

  2 of my hosting clients that have staged sites with me (not on wordpress.com) received a message:
  
  

  Confirm your email address

  Thanks for joining WordPress.​com! To fully activate your account, we need to double check your contact information. Visit the link below to confirm your email address. 

  If you didn’t sign up for WordPress.​com, please ignore this email. 

  
  
  

  The link on the email to confirm their address goes to “https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fwordpress.com%2F%3Fverified%3D1“
  
  I haven’t used their emails for anything as of yet because both of these websites are hosted with my own account on Nexcess (Not WordPress.com). Nor are either of these clients purchased domains from WordPress.com
  
  Any thoughts on this, or if it’s legitimate? Did WordPress.com have some issue recently? Or is it possibly an issue with the hosting provider?

• 

  staff-totoro · Staff · Nov 30, 2023 at 11:52 pm

  • Copy link

  Hi there,

  The email you have shared sounds correct, and is typically one we send when creating a new WordPress.com account. It does sound like your self-hosted (staged) sites would not be connected with our login system, but it may be the case that they have both installed and activated the Jetpack plugin on their sites.

  To explain, Jetpack is our plugin and adds the cloud-hosted features we pre-install on WordPress.com sites to any “self-hosted” WordPress site. When you activate this plugin you are asked to create a WordPress.com account (which allows us to make the connection to the site to share services) and that would result in an email like this being sent.

  You may wish to confirm with your clients to see if they may have activated Jetpack recently. They may not have understood that doing so will require the creation of a free WordPress.com account. If so then it is recommended that they confirm their accounts, otherwise the plugin will not offer full functionality.

  Hope that helps. Please let us know if you have any more questions.