September 9, 2026
Webnames.ca has identified a phishing campaign targeting email users with fraudulent messages that impersonate Webnames.ca and attempt to steal email account credentials.
These messages are not legitimate and were not sent by Webnames.ca.
What the Fraudulent Email Looks Like
Customers have reported phishing emails with characteristics similar to the following:
Subject/Theme:
- Webmail functionality updates
- Compulsory email update notices
- Mailbox upgrades or service interruptions
Reported Sender Addresses:
info@ds-roofing.co.uksped@alfons-koester.cz- Other unrelated third-party email addresses may also be used.
Sample Message Content:
WEBMAIL FUNCTIONALITY UPDATES
NOTE: Compulsory email update for all users
Dear [email address],
This is a notice to inform you that we have released a new webmail app for good email performance. Login with the link below to automatically update your email account from being interrupted and disconnected.
Update Email Now
Webnames I.T Teams
How to Identify This as a Phishing Attempt
The reported emails contain several common phishing indicators:
- The message originates from a domain unrelated to Webnames.ca.
- The email urges immediate action to avoid service disruption.
- Generic language such as “Dear user” or the recipient’s email address is used instead of personalized account information.
- The message claims that an email update is “compulsory” or required to prevent interruption.
- Clicking the provided button directs users to a credential harvesting website designed to steal usernames and passwords.
Webnames.ca does not require customers to “upgrade” or “update” their mailbox through links sent from unrelated third-party email domains.
What You Should Do
If You Received the Email
- Do not click any links or buttons.
- Do not enter your email password or account information.
- Delete the message or mark it as phishing/junk.
- Forward the message as an attachment to abuse@webnames.ca for investigation.
If You Clicked the Link But Did Not Sign In
- Close the webpage immediately.
- Do not enter any information.
- Run your antivirus or endpoint security software.
- Continue to monitor your account for suspicious activity.
If You Entered Your Password
If you submitted your email credentials through a phishing website, take action immediately:
- Change your email password without delay.
- If you are unable to change your password, use on the the two available password reset options, as outlined here: https://webnames.help/en/articles/16891107-how-to-reset-an-email-account-password
- Change passwords on any other accounts where the same password was used..
- Review mailbox forwarding rules, filters, and account settings for unauthorized changes.
- Contact Webnames.ca Support immediately.
If You Use the Same Password Elsewhere
Credential theft campaigns frequently attempt to use stolen passwords on multiple services. As a precaution, change the password on any other accounts that share the same or a similar password.
Legitimate Webnames Communications
When Webnames.ca contacts customers regarding email services:
- Messages will not instruct customers to update a mailbox through an unrelated third-party website.
- Password verification requests should always be treated with caution.
- If you are uncertain about the legitimacy of an email, do not click any links. Instead, open a new browser window and access your Webnames services directly, or contact our support team.
Webnames Recommendation
Customers should remain alert for any unexpected emails that create urgency, threaten service interruptions, or request login credentials. Cybercriminals frequently impersonate trusted service providers, and phishing messages may appear convincing even when they originate from unrelated domains.
If you have any concerns regarding a message claiming to be from Webnames.ca, please contact our support team before taking any action.
Webnames.ca Support
- Phone: 1-866-221-7878
- Email: support@webnames.ca
We continue to monitor and investigate reports related to this campaign and appreciate customers who report suspicious messages.