Spoofing, phishing: what you need to know about these fake LWS emails

Procédure

Have you received an email in your email account that uses the LWS company codes (colour, logo, content of the email), asking you to pay for the renewal of a service quickly, or risk having it deleted?
This is a fraudulent attempt to get money out of you.

Definition of spoofing and phishing

LWS and its customers are the targets of phishing campaigns that are constantly evolving.
The aim of these campaigns is to obtain your login and bank details.

Spoofing is electronic identity theft. The sender pretends to be someone else (in this case LWS) in order to send requests in the name of the third party whose identity they are impersonating.
The aim of phishing is to steal your login details or bank card numbers.

How can you recognise a fraudulent email?

These emails are not sent from the address: noreply@lws.fr, but from a third party address.
Here is an example of a malicious email, to help you recognise them:

example of email number 1 :

example of mail number 2 :

example of mail number 3 :

example of mail number 4 :

How can I check that the email has been sent from an @lws.fr address?

You can reply to the email you receive, in order to see which address is sending this email, if you have, for example :

For example, for this email, it is SPAM, do not ignore it.

Emails related to LWS services are sent from an @lws.fr address.

If you have the slightest doubt about an email telling you that your domain needs to be renewed, please go to your customer area to check the expiry date of your domain.

How should I react to phishing?

If you have received this email or one like it, do not click on the link.

• Check your LWS customer area for the expiry date of your domain/hosting space.
• You do not need to contact our customer support, which has already taken steps to stop this type of email being sent.

On a site imitating LWS, did you enter your login details?

Your password must have been recovered by malicious persons as a result of the information provided.
Please change your password as soon as possible to access your LWS customer area.

Have you made a payment on the website mentioned in these emails?

Please contact your bank immediately to request that your bank card be blocked.

Your bank will also be able to advise you of the next steps to take, in particular the need to lodge a complaint for fraudulent use of a means of payment on the Internet.

To counter these phishing campaigns, our technical teams, like other email and hosting providers, deploy countermeasures to limit the impact on our customers.

As these counter-measures are put in place, attackers evolve their own phishing campaigns by regularly modifying the sending email addresses, the content of the message and/or the websites used.

As a reminder, we recommend that you check your LWS account at https://panel.lws.fr each time you receive a payment request.

How to detect a phishing email