Pause before using an unexpected link
Open the hosting panel through a route you already trust and compare its full address before entering any credential.
A message can mimic Novasean branding while leading to a different domain. Do not enter a password, one-time code or recovery code until you have checked the destination independently. Urgent claims about suspension, renewal or a security incident are reasons to slow down, not to trust the link. A familiar logo and HTTPS padlock only show that the page looks polished and has a connection to its displayed host; they do not establish that the host belongs to Novasean.
DirectAdmin permits administrators to customise its login appearance. Therefore visual similarity to a panel you remember is weak evidence of authenticity.
Open the account route independently
Close the message link and open a previously saved bookmark or type a known Novasean account address yourself. The public Novasean site links to its client area; use that known route to reach your account and follow any panel link supplied there for your actual service. Check the full browser hostname and path before signing in. Watch for a look-alike spelling, extra subdomain or a URL that starts with a trusted name but ends at another host.
If you do not know the correct panel address, use an independently known Novasean contact route to ask. Do not rely on the telephone number or reply address in the suspicious message itself.
Check the claim without using the suspect page
Inside the genuine client area, look for the invoice, service state or support notice that the message claims exists. A real issue should be confirmable through an authorised route or support conversation. If the account has no matching notice, retain a screenshot or message headers for a report but avoid opening attachments or repeated links. Report the suspicious message through your known support channel without forwarding passwords or personal account details to an unknown address.
Use your normal multi-factor method only after the destination is independently verified. A prompt asking for several one-time codes or recovery codes is a strong reason to stop and contact support.
For example, an urgent email's login link can use familiar branding on another registrable domain. Open the saved client-area route independently, then report the suspect link without entering a code.
If you already entered credentials
Return to the known genuine route on a trusted device. Change the affected password and any reused password, review available multi-factor and login-key settings, and contact Novasean support promptly with the time and suspect URL. The separate compromised-password guide covers recovery after suspected exposure. Do not try to recover by entering new credentials into the page you suspect.
Frequently asked questions
Does a valid certificate prove the login is genuine? No. It validates the connection to the host shown in the address bar; a deceptive host can also have HTTPS.
Can I use the link after support confirms a real incident? Use the independently known account route or ask support for a route you can verify against it.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.