Have you received an email signed “OVHcloud” warning you that your domain name will be permanently deleted within 3 days unless you renew it immediately? Be careful. This campaign impersonates the French hosting provider OVHcloud using a particularly clever trick. Here is how to check and what to do.
Is this OVHcloud email a scam?
In the case documented here, yes. The email faithfully copies OVHcloud’s visual identity (logo, signature blue, layout) and displays your real domain name, which makes it credible. But the real sender gives the fraud away: the address is support@mydomain.ovh, and SPF fails, meaning the sending server is not authorised to send emails for that domain.
The “Renew my service” button also points to vimeu.test-app.link, a redirect link with no connection to OVHcloud.
What trick makes this scam so convincing?
The key element of this campaign is the sender address: support@mydomain.ovh. The .ovh extension is a real domain name extension, managed by OVHcloud. The scammers simply registered a domain name ending in .ovh (here mydomain.ovh), which lets them display “ovh” in their email address.
The result is misleading: a hurried recipient sees “ovh” in the address and concludes the email really comes from OVHcloud. It is a deliberate confusion between the .ovh extension (which anyone can buy) and the official ovh.com domain (which only the company owns).
To be clear: support@ovh.com could be legitimate, support@mydomain.ovh is not. The extension after the final dot never guarantees who the sender is. It is a form of typosquatting applied to the domain extension rather than to its name.
What other signs give this email away?
Several clues confirm the fraud beyond the sender address.
Urgency and the threat of permanent deletion. “Without payment within 3 days, your domain name will be permanently deleted.” OVHcloud never acts like this: a domain name that is not renewed goes through a redemption period of several weeks during which it can still be recovered. The threat of immediate deletion is artificial pressure.
The external redirect link. The button points to test-app.link, a redirect (deep linking) service hijacked to hide the real destination. A legitimate OVHcloud renewal always takes place on ovh.com or ovhcloud.com, never through a third-party service.
Empty footer links. The “Customer area”, “Webmail” and “Resources” links at the bottom of the email lead nowhere: they are links without a destination, a sign of a template copied hastily and carelessly.
Hidden tiny text. The email contains very small text intended to fool spam filters, a classic concealment technique.
How to check the real status of your domain name
Never click the button in a renewal email. Log in directly to your OVHcloud customer area by typing ovhcloud.com or ovh.com into your browser yourself, then check your domain names section. The real expiry date and any pending renewals are shown there.
You can also publicly check the expiry date of any domain name through an official WHOIS service. If the date shown is far off, the email is fraudulent. If in doubt, contact OVHcloud support through your customer area, never through a number or link in the suspicious email.
What to do if you clicked and paid
If you clicked the link but did not enter anything, close the page and do not go back to it.
If you entered your OVHcloud credentials on the page, log in immediately on the official site and change your password. Enable two-factor authentication on your account: unauthorised access to your hosting space would let an attacker hijack your domain names, websites and emails. See also our guide on what to do if your account is compromised.
If you shared bank details or made a payment, call your bank right away to block the card. Report the email on Signal Spam and on Cybermalveillance.gouv.fr.
Why are domain name owners targeted?
This scam targets a specific group: website owners, entrepreneurs, freelancers and webmasters. The attackers have two goals: extract a fraudulent payment, but above all steal the credentials to a hosting account. A compromised OVHcloud account gives access to domain names, websites, databases and the associated business email addresses, potentially major damage for an online business.
Target address lists are often built from public WHOIS data, which links a domain name to a contact email, or from data breaches. It is the same logic of exploiting accessible data as in the other campaigns documented on safecode.fr, such as the fake bank alerts in the name of Société Générale or the fake Ledger email targeting crypto holders. To strengthen your protection, see our digital hygiene rules.
Check the sender’s full address: OVHcloud sends from the ovh.com domain, not from a domain that simply ends with the .ovh extension, such as mydomain.ovh. Log in directly to ovhcloud.com by typing the address yourself to check the real status of your domain, without clicking the links in the email.
No. The .ovh extension is a domain name extension anyone can buy, just like .fr or .com. An address like support@mydomain.ovh has no connection with OVHcloud. Only the official ovh.com domain belongs to the company. The extension after the last dot never guarantees who the sender is.
No. A domain name that is not renewed does not disappear immediately: it goes through a suspension period and then a redemption period of several weeks during which its owner can still recover it. The threat of permanent deletion within 3 days is a typical pressure technique used in fraudulent emails.
Leave a Reply