Nobody is going to guess your password. They are going to ask you for it, in a way that seems reasonable at the time — and the times it seems most reasonable are exactly when it is most dangerous.
The four you will actually meet
| Approach | How it looks |
|---|---|
| The fake panel login | A link that looks like your panel, on a domain that is one character off. |
| The «I'll help you fix it» | Someone helpful in a Discord asking for SFTP details to look at your problem. |
| The free plugin or pack | A download that solves your exact problem, hosted somewhere you have never heard of. |
| The staff impersonation | A message claiming to be from support, asking you to confirm something urgently. |
Not on Discord, not in a ticket, not to «verify» anything. Anyone who asks is not us, regardless of the name, avatar or urgency. The same applies to your SFTP password, which is your panel password, and to any two-factor code — those are single-use and asking for one is always an attack.
The habit that stops all four
- Navigate, never click
Type the panel address yourself, or use your own bookmark. A link in a message is the one thing every version of this attack depends on.
- Slow down when it is urgent
Urgency is the tool. «Your server will be suspended in one hour» exists to stop you checking. Anything genuinely urgent will still be there in five minutes.
- Check the domain character by character
Not the look of the page — the address bar. Substituted letters and extra words are the entire technique.
- Refuse to hand over access to help you
A person who genuinely wants to help can tell you what to do. Someone who needs your credentials to help you is not helping you.
What to do if you already entered it
Change the password immediately, from a page you navigated to yourself. Then change it anywhere you reused it, check the activity log for logins you did not make, and look at the Startup and Settings tabs for changes. Speed matters more than working out how it happened; the investigation can wait ten minutes and the password cannot.
«Nobody will ever ask you for your password, including me» pinned somewhere is worth more than any technical measure, because it converts a moment of uncertainty into a rule they already know.