Clever cPanel Phishing Scam

[UKSBD]

I don't normally spread these scam warnings around but this is a particularly clever one and could catch out people who click on links and don't notice URL's in the address bar

I received an email supposedly from my cPanel account warning about disk quota error and with a link to sort it out.

Anchor text of the link is your own website, look at the source though and it's not

it takes you to an exact copy of your cPanel login

if people click on it, don't notice URL in address bar, enter username and password they are effectively sending the scammer their web address, cPanel username and password.

 

[WebDesires]

This has been going on for years, it isn't anything new.

There is also a variant of this saying email address will be deleted or etc if you don't act which is also surprisingly quite clever crafted.

always check urls BEFORE (do not open if the domain is weird or the string has identifiers in them) and after you have opened them with any email, whether it looks legit or not. Should be the norm for everyone, even beginners should know this, no email can be 100% legitimised EVER.

 

[UrbanRetail]

I only login to my cpanel via the client area on my hosts site after receiving these exact emails.

Probably isn't fool proof, but if they get hacked I'll have bigger problems to worry about.

 

[gpietersz]

I do not use cPanel. If I did I would lock it down (only whitelisted IPs or only accessible over an ssh tunnel or similar). Having a web admin that anyone can access greatly increases the attack surface.

People should know not to click on links in emails unless its definitely needed (e.g. email verification links).

I keep getting emails telling me that I need to click on a link to solve a problem with my Office 365 email. Funny when I run my own mail server (for some domains) or use a smaller provider (for ones I have not moved yet).

 

[14Steve14]

I get several emails a week telling me CPanel is holding emails back and I need to click a link to see what they are. Never click links in emails so don't know if its genuine or not. I seem to get all my emailsand hosts say its a scam. Blacklisting them just seems to create a new from email address.