Skip to main content
ThreatPhishing & impersonation

Fake Wix / Squarespace / Weebly website builder subscription billing or site offline phishing — fraudulent email impersonating Wix, Squarespace, or Weebly claiming the recipient's Premium plan payment has failed, their website plan has expired, or their website is now offline — directing them to sign in, update billing, or renew their plan to restore their website — a credential-harvesting and payment card theft attack exploiting the catastrophic urgency of a business website going offline; Wix has 220M+ registered users, 6M+ paid plans; Squarespace 4M+ paid subscribers

fake-wix-squarespace-website-builder-billing-phish

What this tier means

High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.

How Gorganizer detects this

Phishing emails impersonating Wix, Squarespace, Weebly, or Webflow claiming the recipient's Premium plan payment has failed, their website plan has expired, or their website is now offline — directing them to sign in, update billing, or renew their plan to restore their site. Key facts: (1) Wix has 220M+ registered users and 6M+ paid Premium plans; Squarespace has 4M+ paid subscribers; for a small business, e-commerce store, or service provider whose website IS their primary business presence, an "offline" notification creates extreme, immediate urgency that overrides careful sender verification; (2) The "your website is now offline" and "visitors will see an error page" variants are particularly effective because they trigger fear of reputation damage and immediate revenue loss — an e-commerce store offline for even a few hours loses orders, and a local business with no website loses appointment bookings and customer calls; (3) Attackers harvest both the Wix/Squarespace account credentials (giving access to the website CMS, all published content, domain settings, and any stored customer data) AND the payment card on file for ongoing subscription charges; they may also redirect the domain to a different server (phishing page, scam page, or competitor redirect) causing lasting SEO and reputation damage; (4) The attack is opportunistic: many small business owners manage their own websites and are not technically sophisticated — they receive real billing notifications from Wix/Squarespace regularly and have been conditioned to click and update when prompted. Warning signs: sender domain not wix.com or squarespace.com; no reference to specific plan name, website URL, or next billing date; link to non-official login page; urgency about website going offline immediately.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started