Squarespace Scams Are Out There. Can You Spot Them?
Scammers and phishers sometimes attempt to scam or steal access to your website through official looking emails that could appear to come from either OmniWorx Design or Squarespace. Don’t be fooled by these emails. Here are some tells and things to look for when you get a suspicious email and some general advice. When in doubt, feel free to reach out to us using known email and phone numbers for authentication.
During our transition to Loon in the Mist Creative emails may come from either @omniworxinc.ca or @loonmistcreative.ca domains. We are working hard to have everything transitioned over by May 1st 2026.
Let’s take a look at two emails my clients have recently received and how to spot phishing attempts impersonating Loon in the Mist Creative.
Subscription Issues
Phishing Scam.
A client recently forwarded this email to me asking if it was real? The answer is no. There are a couple of clear tells that you can see listed below.
Double check the from email, not just the name of the sender. Is it from the right email address?
Urgency in action or alarming subjects. In this case the subject includes “Your subscription has been canceled”. Squarespace would always send you proactive emails first if there is a true issue with your payment method. If you are concerned, you can reach out to us to verify. We will also often also proactively reach out to clients if we get legitimate notifications as we also get notifications if we are still connected to your site.
Do not click on email links. If you want to check your account log in through Squarespaces official site at www.squarespace.com.
Outdated or Incorrect Verbiage. Look for things like Premium Plan for Your Domain. Firstly Squarespace would know exactly what domain was a problem. Second that isn’t a a “Premium Plan” for a domain isn’t an offering that exists. That isn’t even the wording used for Squarespaces hosting plans.
In this particular email, though possibly not always the status, date and annual fee are blank. A legit email from Squarespace would know this information.
Email Footer & Contact Information. Squarespaces legal name is Squarespace, Inc. not squarespace.com Ltd. Also Squarespace does not have offices in San Fransiscio, Thier head office is New York, with an office in Portland in the US. There are also international offices in Dublin, Ireland and Aveiro, Portugal.
Communicating via Your Sites Contact Form?
A client received this recently about a security alert that their site supposedly triggered. This is also not a real communication from Squarespace.
This email came through the websites contact form. Squarespace has your contact information and they know the name of the site owners including our information. They do not need to reach out to you through your website forms for any reason as they already have your direct contact information.
Look at the reply to email. It isn’t even from any domain closly related to Squarespace. its a Gmail address. Any email supposedly from Squarespace coming from a Gmail address should be reported as junk and/or reported as phishing and deleted immediately. Report Squarespace phishing to reportphishing@squarespace-security.com. Read the article here for more details and tips.
Look at the address. Again they are not providing an address.
Phishing Attempts Impersonating Loon in the Mist Creative.
There have been reported incidents of scammers targeting clients of Squarespace designers, like Loon in the Mist Creative, with scam and phishing emails. So far we have not been made aware of any emails to clients impersonating us as either OmniWorx Design or Loon in the Mist Creative but here are some things that should make you sceptical of any emails should you receive something suspicious.
Check the email domain name. Real communications from us will be from @omniworxinc.ca with a transition over to @loonmistcreative.ca.
What is the email asking. If they are asking for access to your website that should also be an immediate red flag because unless you have removed us explicitly we maintain access to our clients site through a 2FA protected account where we also host our own site. We likely already have access to your site so we don’t need to ask for it again. That is likely sign of someone trying gain access for nefarious purposes.
If you have any questions or concerns with any communications you receive, feel free to reach out to us through known channels, not by replying to the suspicious email, and we will be happy to verify if it is a legitimate communications.
Please note that you may also receive automated emails from our project management system Bonsai about your project ie invoices or forms to fill out but the reply to and from emails should always be @loonmistcreative.ca.