fren
Log In

Protect accounts against phishing

3 min read07 November 2026

Phishing targets more than your inbox: the account that controls your services, invoices and domain names. A page imitating the dashboard, a Discord message or a fake invoice is enough to capture a reused password. Defence relies on simple habits applied before the incident.

Recognise an attempt

A credible message is not a safe message. The most reliable signals are urgency, a request to enter a password, a verification code being sent, and a domain that resembles the real one without being identical.

Signal Reflex
"Log in to avoid suspension" link open https://dash.neoheberg.fr from a bookmark
"Invoice" or "refund" attachment check invoices inside the dashboard
2FA code requested by message never share it, even with support
Similar but different domain read the hostname character by character
Page asking for credentials after a click close the tab and start from the official address

The HTTPS padlock proves nothing: a valid certificate means the connection is encrypted, not that the site is legitimate. An attacker can obtain a certificate for a misleading domain in minutes.

Passwords and a password manager

Use a password manager and let it generate a unique secret per service. It fills in the correct domain and refuses to enter the password on a different origin, blocking many copied pages. Protect the manager with a long passphrase and two-factor authentication.

Never reuse the dashboard password for root on a VPS, for a database or for an FTP account. A leak on an unrelated site must not open your servers.

Two-factor authentication

Prefer a TOTP app or a hardware key over SMS, which is vulnerable to number porting. Keep recovery codes offline, away from your phone. Refuse any approval request you did not start: MFA fatigue attacks send notifications until the victim accepts.

A TOTP code expires within tens of seconds. Sharing it, even with someone claiming to be support, gives away access.

Protect your domain and email

A domain without SPF, DKIM and DMARC can be spoofed to send messages to your own customers. Publish these records, start with a DMARC policy in monitoring mode (p=none) with a reporting address, then tighten to quarantine or reject once reports are clean.

Also check forwarding and auto-reply rules in your mailboxes: a rule added by an attacker lets them read messages without changing the password.

If you clicked

  1. Change the password from a device you trust, then revoke active sessions.
  2. Enable two-factor authentication and regenerate recovery codes.
  3. Rotate exposed secrets: SSH keys, API tokens, database passwords, FTP accounts.
  4. Check services, invoices, Coins and email rules.
  5. Tell support through the dashboard and watch logins over the following days.

Finally, verify your setup:

Bash
dig TXT _dmarc.your-domain.tld +short

The answer should contain your policy, and the dashboard session list should contain no unknown device.

Advertisement

Was this article helpful?

Read next