Beware of FAKE Email Saying Your Cpanel Account Suspended

[2die4]

Thought I would let everyone know to beware of an email saying "Your Cpanel Account Suspended" which displays the url cpanel.net/login but when you hover over the link. It is actually another domain which links to a url like domain.ca/images/www/cpanel.net/.

The email asks that you login due to a security upgrade to avoid multiple logon and unauthorized access to your online cpanel and FTP account with your domain name, username and password for a security check which you SHOULD NOT DO. The email then says they will send you a security code to your email to confirm your domain has been verified and secured. In addition, it also adds that you have 2 days to do so.

 

[vikins]

Here's the thing. One of our customers got this same email, but only AFTER him and another person did login to the same cPanel account to try and resolve an issue. What I am saying is, this phishing email our customer received was sent completely in the context of a real event! What the heck is going on here? I've opened a ticket with cPanel.

 

[cPanelMichael]

Hello

I have moved this thread into the "Security" forum for you. As for the email being sent out after a cPanel login, it sounds like that could be a coincidence, however feel free to provide the ticket number or let us know the outcome of the ticket.

Thank you.