In this article you will learn:
- How to verify the authenticity of an email from VEDOS
- How to quickly check the status of your services
- How to report a phishing attempt made in the name of VEDOS
- What to do if you entered the following on fraudulent pages:
- Frequently Asked Questions
Verifying the email
If you receive a suspicious email warning about the expiration of a domain, Webhosting, or another service, verify it with these steps:
- Check the sender’s email address. Even if the sender’s name is VEDOS or some variation of it, check the sender’s email address. If an email from a sender named VEDOS (WEDOS) does not come from the domain
@wedos.comor@vedos.cz, it is probably a forgery. This also applies to typo-squatted and similar domains, such as:@vvedos.com– two letters v next to each other look like w, a so-called typo-squatted domain,@wedos-webhosting.cz– the first part is correct, the second one extends it in some way,@wedos.app– correct name, wrong extension, orwedos@somedomain.tld– the wedos mailbox, wrong domain.
- Check the link targets. The target of any link for managing a service or making a payment should start with the address of the customer administration, i.e.
https://client.wedos.com/. Always check the real target of the link, not just the text you are clicking. As in step 1, you may encounter typo-squatted or otherwise forged domains here as well.
VEDOS never shortens links to the administration. Links like wds.cz/abcdef or bit.ly/123456 are forgeries.
You can find the real address of a link by hovering your mouse over it – the browser usually displays it in the bottom left corner of the screen.
It is far from true that fraudulent emails look sloppy (or are completely unformatted) and are written in poor language. Thanks to artificial intelligence, it is very easy to create, practically for free, an email whose polished look and language inspire trust. However, scammers still like to rely on high urgency: they try to force you to act as quickly as possible so that you overlook the warning signs until it is too late.
Checking the status of services
If a fraudulent email has nevertheless made you worried about the status of your services, check them directly in the administration. The easiest way is to check the list of orders using these steps:
- Log in to the Customer Administration ⧉.
- In the navigation bar, click Billing.
- In the left menu, select Orders.
In the displayed list of orders, you will immediately see which service is paid and which is not. You can find more information in the article Billing – Overview of Orders and Documents.
Keep in mind that a domain and Webhosting are separate services. You need both to run a website (and email).
If you do not see the service here at all, make sure that:
- the service is operated by VEDOS,
- you are logged in to the correct customer account.
If you cannot find the service, ask Support for help ⧉. Provide the name (domain, e.g. wds-test.cz) and the type (domain, Webhosting) of the service you are looking for.
Reporting phishing
If you receive a fraudulent email, follow these steps:
- Do not click any links or buttons in this email.
- Following the guide for your email client, obtain the message header (you can find a sample header and a guide for WebMail here).
- Report the phishing using the form. Attach the obtained header and, if available, other materials such as screenshots, the target addresses of links, and so on (if you can obtain them safely).
Getting the email header in WebMail
The email header contains detailed information about the message that can be used to diagnose problems. In WebMail, you can display it by clicking the arrow on the right side of the block with the message information.
In WebMail, we also recommend opening the email in text format (see the image).
Forged pages
The most common pages you will encounter in phishing are:
- Customer Administration: A forged WEDOS administration tries to lure login credentials out of the victim so that the attacker can log in and abuse the services. Resolve this by changing your password at https://login.wedos.com/login/newpwd.html ⧉ and by thoroughly securing your account following the guide Administration – Customer Account Security. You can find a detailed guide in the subsection Forged Customer Administration.
- Payment gateway: A forged payment gateway often requests a completely different (higher) amount from the card than the one the fraudulent email mentions, or directly requests card details, which the attacker then has at their disposal. Contact your bank immediately. You can find more information in the subsection Forged Payment Gateway.
Forged Customer Administration
The unified login interface for the WEDOS and VEDOS administrations always has the address https://login.wedos.com.
If you entered your login credentials at a different address:
- At the link https://login.wedos.com/login/newpwd.html ⧉ change your password.
- Log in with the new password to the Customer Administration ⧉.
- At the link https://client.wedos.com/client/account-security.html ⧉ click the button Log Out All.
This stops the immediate threat.
We also recommend enabling two-factor authentication, or at least login confirmation using a link in an email notification, following the guide Administration – Customer Account Security.
Forged Payment Gateway
The WEDOS and VEDOS payment interface always has an address in the form https://client.wedos.com/pay/order.html?n={cislo_objednavky}&k={overovaci_kod}.
If you entered payment details or made a payment at a different address, contact your bank immediately regarding further steps. In this case, we unfortunately cannot help you in any way.
Frequently Asked Questions
Can’t you prevent these forgeries?
In the age of artificial intelligence, an email or a website can be forged very easily. There is no control mechanism that would prevent anyone from uploading our logo to any website or inserting it into an email. The only defense against phishing is therefore the vigilance of customers who keep track of when their services expire and consistently check the origin of email communication and the flow of the payments they send.
How do you deal with phishing?
After phishing is reported, we arrange for the swift blocking of the harmful content, especially the website on which the forged pages run. This content is rarely under our control, so its removal depends on the response of the hosting provider on which the harmful content is located.
What should we do if we have already entered login or payment details in a fraudulent email?
If your login credentials for the Customer Administration are affected, change them as soon as possible by following the guide Administration – Customer Account. In this guide you will also find information about other security measures that can prevent a fraudster from logging in to the account even if they find out the username and password.
If payment details have been stolen, cooperate with your bank and, if necessary, the police.