Attackers impersonate web hosts and developers because those messages carry natural authority. A fake "your domain is expiring" or "urgent server issue" notice can look convincing. Here is how to check.
Check the sending domain carefully
Legitimate mail from us comes from an address ending in zylax.com.my. Look at the full address, not the display name, which anyone can set to anything. Watch for lookalikes such as extra letters, hyphens, a different extension, or a subdomain arrangement that puts our name in front of somebody else's domain.
Signals that something is wrong
- Urgency and threat combined. Domain suspension today, site deletion in twenty four hours, legal action.
- A payment request to bank details that differ from your previous invoices, or a message saying our banking details have changed.
- A link to a login page. Never log in through a link in an email. Type crm.zylax.com.my yourself.
- An attachment you did not expect, especially a zip, an executable or a document that asks you to enable macros.
- Generic greetings, no ticket or invoice number, and no reference to any conversation you actually had.
Domain expiry scams
These are common and specifically target business owners. A letter or email offers to renew or "secure" your domain, sometimes on official looking paper. If we manage your domain, renewals come from us as an invoice in the portal at crm.zylax.com.my. Anything else should be checked before payment.
Verify before you act
If a message claims to be from us and asks for money, credentials or an urgent change, do not reply to it. Open a ticket in the portal or email [email protected] directly and ask. We would far rather answer ten checks than deal with one successful fraud.
If you already clicked
Change the password on any account whose credentials you entered, from a different device. Tell us straight away so we can watch for unusual activity on your services.
Forward anything suspicious to [email protected] or reply to your email thread with us.
