Please be advised that we’ve been seeing an increase in the number of cPanel phishing emails being reported to us. Phishing emails are those that look like legitimate emails but they often contain malicious links disguised as legitimate ones in an attempt to obtain login information from the recipient.

As an example, below is a redacted copy of an email that one of our clients received just a few days ago.

These emails will include your actual domain name and at first glance, will look like a legitimate cPanel disk quota notification. The anchor text of the links even correctly points to cPanel URLs on your domain. However, if you hover over those links, you can see in the bottom left corner that their target is a third party phishing website on an unrelated domain. If you were to enter your cPanel login information at that URL, attackers would then have your login information and use it for malicious purposes.

The best way to avoid getting phished is to not click on links in emails. Instead, visit cPanel or whatever service you need to by directly entering the address into your browser. Once you login, you may find that the details in the email (disk usage in this case) don’t align with reality which can be a good indicator that this was a phishing attempt. In this particular case, though, the client’s domain was actually quite full so that alone wasn’t helpful in distinguishing a difference.

If you ever have concerns about the legitimacy of any such email notifications just submit a ticket with the full headers and source of the message and we would be happy to take a look for you. It’s always best, though, to just assume the worst and not click on any of these links. Instead, just enter your desired destination directly in your browser.