SiteSupport - IT Consultants

Your domain name, the yourbusiness.com behind your website and email, sits in an account at a registrar like GoDaddy or Namecheap. If someone gets into that account, they can point your website wherever they want, take over your email, and lock you out of your own name.

Lock it down:
▶️ Put a strong, unique password and MFA on your registrar account.
▶️ Turn on the domain lock (sometimes called a transfer lock or registrar lock). It stops your domain from being transferred away without you approving it.
▶️ Make sure the email address on the account is one you control and is itself secured. If that inbox gets hacked, someone can reset the registrar login.
▶️ Set the domain to auto-renew, and keep a card on file that won't expire. Businesses lose domains every year just by forgetting to renew.

If you're not sure who has access to your domain account, or whether MFA is even on, that's worth finding out this week.

Even with strong passwords and MFA, your Microsoft 365 or Google Workspace lets someone try to log in from anywhere in the world, on any device. You can change that with a few rules.

These are called conditional access rules. They let you control who can log in, from where, and on what device. If your business only operates in one or two countries, you can block sign-ins from everywhere else, which blocks most attackers right away. You can also require logins to come from a known device, or catch a login that happens in London ten minutes after one in Texas, which is a clear sign of a stolen password.

You don't set these up yourself. Ask your IT provider to turn on a few rules for you: require MFA on anything unusual, block the old sign-in methods that skip MFA, and block logins from countries you don't do business in.

If you run client calls, team meetings, or webinars over Zoom, Teams, or Google Meet, pay attention to these settings to keep uninvited people out:

▶️ Turn on a waiting room, so you approve who comes in instead of letting anyone with the link walk straight in.
▶️ Add a passcode, so the link alone isn't enough to join.
▶️ Lock the meeting once everyone's arrived, so no one can join partway through.
▶️ Limit screen sharing to the host, so a random attendee can't take over the screen.

And don't post meeting links on public pages or social media. Send them straight to the people who need them. If you record meetings, treat those recordings like any sensitive file, because they often capture confidential conversations.

Technology should support your business—not slow it down.

SiteSupport delivers reliable, practical IT solutions that help businesses stay connected, protected and productive. With an experienced local team behind you, you can focus on running your business while they take care of the technology.

Visit www.sitesupport.com.au

Local team. Local knowledge. Local IT support.

Behind SiteSupport is a team of real people who understand local businesses and the importance of keeping your technology working when you need it most.

For friendly, reliable IT support from a team close to home, visit www.sitesupport.com.au

There's a scam where a criminal takes over your phone number, and once they have it, they can get into a lot of your accounts.

It's called SIM swapping. The attacker calls your mobile carrier, pretends to be you, and convinces them to move your number to a SIM card they control. Now your calls and texts go to them instead of you. That includes the security codes banks and other services text you, so they can reset your passwords and get into your accounts.

The main thing that stops it is a PIN on your mobile account. Every major carrier lets you set one, and then nobody can move your number without it. Call your carrier or check your account settings and turn it on.

It also helps to move your two-factor codes off text messages where you can. An authenticator app or a security key can't be hijacked by taking over your number, so use those for your important accounts.
And if your phone suddenly loses signal for no reason and stays dead while everyone around you is fine, call your carrier from another phone straight away. That's often the first sign someone's stealing your number.

When someone new starts, the rush is to get them working fast, so security often gets skipped. But the accounts and access you set up on day one are the ones that stick around for years.

Get these right from day one:
1. Give them their own accounts, never a shared login. That way you know exactly who did what, and you can switch off their access cleanly when they leave.
2. Give them access to only what they need for their job, nothing more. It's easy to add more later, and much harder to claw back access you handed out by default.
3. Turn on MFA from their very first login. Don't leave it for later.
4. Set them up on a company device. If they're using their own, make sure it has a screen lock, automatic updates, and your basic protections.
5. Spend ten minutes walking them through the basics: how you handle passwords, what to do with a suspicious email, and who to tell if something feels off.

The smart devices around your office, security cameras, smart TVs, thermostats, video doorbells, even the coffee machine, are small computers connected to the internet. Most of them are far easier to hack than your laptop, and hardly anyone touches their settings after plugging them in.

The problems are usually the same: a default password the manufacturer set (and attackers know), no security updates, and remote access left switched on. A hacked camera or doorbell can spy on you, or give an attacker a way onto your network.

Do this:
▶️ Change the default password on every smart device to something unique.
▶️ Check for firmware updates, and turn on automatic updates if the device offers it. If a device no longer gets updates, plan to replace it.
▶️ Turn off any remote access or cloud features you don't use.

You don't need to do all your devices at once. Start with anything that has a camera or microphone, and anything that can unlock a door.

Got an IT question or need support for your business?

The SiteSupport team is here to help with practical advice and reliable technology solutions tailored to your business needs.

Start the conversation today.

Visit www.sitesupport.com.au

Police have taken down one of the most common ways small businesses get infected: fake "your browser is out of date" pop-ups.

In June 2026, police from several countries shut down a malware network called SocGholish, also known as FakeUpdates. They seized around 106 servers and cleaned up roughly 15,000 hacked websites that were spreading it.

Criminals hacked legitimate websites, often small business sites running WordPress. When someone visited, a pop-up appeared saying their browser was out of date and needed an update. Click it, and instead of an update you downloaded malware, which could lead to ransomware.

The takedown is good news, but the trick isn't going away, because someone always fills the gap. So teach your team one rule: a real update never comes from a pop-up on a website. Your browser updates itself, and you get other software updates from the program itself or your IT provider.

If a website tells you to update something, close the tab.

https://www.helpnetsecurity.com/2026/06/18/law-enforcement-socgholish-operation-endgame/