Keep Your FimuroHost Account Secure and Spot Phishing Emails

Your client area controls your domains, websites, email and payments. If someone else gets into it, they could redirect your domain, change your email or trick you into paying them. A few habits prevent almost every problem, and this guide also shows how to spot fake messages that pretend to come from us.

Security checklist

• Use a strong, unique password of at least 12 characters, stored in a password manager. Change it under account menu → Change Password.
• Turn on two-factor authentication under account menu → Security Settings, if it is offered, and keep your backup code somewhere safe.
• Don’t share your login. Invite developers, colleagues and accountants as users from User Management with only the permissions they need, and remove them when the work is done.
• Protect your email account. Whoever controls your email can reset your client area password, so give your mailbox a strong password and 2FA too.
• Keep your details current, especially your email and phone, so our warnings reach you.
• Log out on shared or public computers, and don’t let the browser save your password there.
• Review your account now and then: users, contacts and domain contact details should all be people you recognise.

What FimuroHost will never ask you for

We will never ask for your client area password, a 2FA code or backup code, a bKash/Nagad/Rocket PIN or OTP, a UPI PIN, or your full card number and CVV, whether by email, phone call, SMS, WhatsApp or support ticket.

You only ever type payment details on the payment page you reach from an invoice inside your client area, or inside your own banking or wallet app. If anyone asks you to send money to a personal bKash, Nagad or bank account instead, don’t pay; check with us first on WhatsApp at 01818160926 or through a ticket.

How to recognise a phishing email

Also be careful with official-looking letters from other companies offering “domain renewal” or “search engine listing” for your domain. These are not from FimuroHost and are not needed to keep your domain.

How to check whether a message is genuine

1. Don’t click the link in the message.
2. Type app.fimurohost.com into your browser yourself (or use your bookmark) and log in.
3. Look under Billing → My Invoices and account menu → Email History. Every real invoice and email from us appears there.
4. If it isn’t there, it isn’t from us. Forward the suspicious message to us in a ticket so we can warn other customers.

If you think someone has accessed your account

1. Change your client area password immediately. If you can’t log in, use Forgot password? on the login page.
2. Change your email account’s password as well, in case that is how they got in.
3. Turn on two-factor authentication, or re-set it up if you think your phone or backup code was exposed.
4. Check User Management and Contacts and remove anything you don’t recognise.
5. Check your domains: nameservers, contact details and whether the registrar lock is on (where the extension supports it).
6. Change the passwords inside your services: control panel users, FTP, email accounts, WordPress admins and VPS root/SSH keys.
7. Tell us through a ticket or WhatsApp at 01818160926 so we can review recent activity with you.

Need help?

Received a message you’re not sure about? Send it to us before you act on it. If anything here doesn't match what you see, or you get stuck, open a support ticket from your client area or message us on WhatsApp at 01818160926. We're happy to help.