Every big house has a lodge at the gate. In the old days a man called Mr Pettigrew sat in it, and everything that arrived for “the Management” went to him: the post, the bills, the keys.
Mr Pettigrew retired last year. The lodge is still there. The door is still unlocked. The bell still rings. And a surprising number of important letters are still addressed to “the Management”.
Welcome to admin@.
Last weekend Gerry, the bookkeeper, who now covers the post on Tuesdays and Thursdays and is not at all sure how that happened, opened it to find: Your domain has a problem. Then: Your invoice failed. Then: Check your account security. Each came with a link to a page that wanted a login, some personal details or a card number. Nothing clever. Rather routine, in fact. That was the cleverness.
The true bit
On 10 October 2026, fake emails pretending to be from Hostico, a Romanian hosting company, started hitting owners of .ro websites. By the next day they were arriving in waves. The messages were nothing special: a domain problem, a failed invoice, an account-security check, and a link to a fake page.
What stood out was who they targeted. Not the chief executive. Not finance. The shared inboxes behind company websites, like admin@ and office@: the inbox whose job is to act on exactly these emails.
What we know, and what we don’t
Hostico warned customers and named two sending addresses. It also said the senders and links were already changing. It hasn’t said how many emails went out or how many people were caught. There is no sign Hostico itself was hacked, and lists of website owners are easy to build from public data.
So this isn’t about one company. It is about how attackers choose their targets.
They target the job, not the person
Who reads your admin@ inbox? A shared team? An agency? Someone who left last year? Does it have two-factor login? Does anyone own it?
That inbox often controls your domain, your website and your email. Lose it, and you could lose all three.
Do this week
- Give every shared inbox an owner.
- Turn on two-factor login for it and for your domain accounts.
- Never fix a billing or domain issue from an email link. Go to the provider’s site yourself.
The moral of the story
Your most trusted inbox might be your least protected one.
Who owns yours?
References
- Hostico, phishing campaign notice to customers, October 2026 (link to be added before publishing).