{"id":6842,"date":"2021-11-19T13:43:27","date_gmt":"2021-11-19T13:43:27","guid":{"rendered":"https:\/\/www.fastcomet.com\/blog\/?p=6842"},"modified":"2022-05-15T13:48:20","modified_gmt":"2022-05-15T13:48:20","slug":"phishing-campaign-targets-cpanel-users","status":"publish","type":"post","link":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users","title":{"rendered":"Don’t Be Fooled! Recent Phishing Attacks Targeting cPanel Users"},"content":{"rendered":"\n

Since April of this year, some hosting providers have reported that their clients are receiving phishing emails via a cPanel impersonator campaign. We did not cover the matter so far, as there were 0 cases in our user base. There was a similar situation back in 2016 during which we did not issue a warning as our users were also not a target. However, we have started receiving reports from our customers in the last few days, which prompted us to publish this warning.<\/p>\n\n\n\n\n\n\n\n

The Deceit <\/h2>\n\n\n\n

This attack in question makes it seem like the cPanel\u2019s system itself is warning the user about high resource usage that must be resolved. In reality, the ones behind it are phishing for the cPanel account login credentials of the user as they provide a link for the \u201ccustomer\u2019s convenience\u201d, which leads to a fake login form. More on fake login pages and other phishing methods can be found in our Phishing 101<\/a> article.<\/p>\n\n\n\n

cPanel has already acknowledged this in an article from the start of 2021, more on which you can read here<\/a>.<\/p>\n\n\n\n

\n\t

Warning<\/strong><\/p>\n\t

If you have already provided your username and password via such an URL in an email, please change your password immediately.<\/strong><\/p>\n<\/div>\n\n\n\n

Here is how the malicious email looks like:<\/p>\n\n\n\n

\"phishing<\/figure>\n\n\n\n

While the current trend is to use the \u201cDisk Quota\u201d other variations with different resource quotas may start circulating in the future.
<\/p>\n\n\n\n

Analyzing the Email, What to do? <\/h2>\n\n\n\n

We know advanced users are more likely to check the email header for information about the actual sender, but learning how to check your emails’ legitimacy is very important. This is true even if you are just starting out getting into hosting and the more intricate parts of it.<\/p>\n\n\n\n

Most email clients and platforms have extra options for each email which you can access by using the Triple Dot<\/strong>, Cogwheel<\/strong>, and \u201cMore<\/strong>\u201d buttons. After that, click on the \u201cShow Original<\/strong>\u201d\/\u201dView Source<\/strong>\u201d option to get an \u201cunder the hood\u201d look for the actual sender of the email.<\/p>\n\n\n\n

Other signs you are being targeted by a phishing campaign:<\/p>\n\n\n\n

  • Your cPanel username<\/strong> is not mentioned. That is because it is not known by the attackers unless you provide them with it. Instead of that, in the subject and body of the email you will see a domain name. Since you can have many domains associated with the same cPanel and the resources are based per cPanel account and not domain, this is a clear sign something is not right.<\/li>
  • A link to cPanel\u2019s Disk Capacity Tool<\/strong>. As there is no such tool in existence, you can be sure this is as big of a red flag as they come.<\/li>
  • Mentioning the percentage of space taken<\/strong>. In actual cPanel emails the used space is also listed in MB. As the attackers cannot know your hosting plan, and how much space you actually have available and use, they generalize the information via percentages.<\/li><\/ul>\n\n\n\n
    \n\t

    Note<\/strong><\/p>\n\t

    Remember that we will never ask you for your cPanel credentials if the account is situated on our own servers. That is due to our Technical team having direct access to all of those accounts.<\/p>\n<\/div>\n\n\n\n

    In the current example, even if you are confident that an email is sent by cPanel, we still advise logging in to your cPanel account on your own without using any of the links in the actual email. You can always login securely in your cPanel by using the appropriate icon on your hosting plan in your FastComet Client Area<\/strong>.<\/p>\n\n\n\n

    A good security measure that cPanel offers is to activate Two-Factor Authentication<\/strong>, which will prompt you with an extra step during the login process. This is unreplicable by an attacker even if they somehow know your username and password.<\/p>\n\n\n\n

    From our end, we are actively blocking IP Addresses via which such emails are send towards our customers. However, due to the easy way this IPs can be changed, we can only lower the number of mails, not zero it completely.<\/p>\n\n\n\n

    You can also contact us anytime you suspect that an email associated with any of the hosting services you use is a phishing\/scam attempt just to be on the safe side.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

    Since April of this year, some hosting providers have reported that their clients are receiving phishing emails via a cPanel impersonator campaign. We did not cover the matter so far, as there were 0 cases in our user base. There was a similar situation back in 2016 during which we did not issue a warning […]<\/p>\n","protected":false},"author":3,"featured_media":6840,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[140],"tags":[4663,8,252,9],"class_list":["post-6842","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-attack","tag-cpanel","tag-phishing","tag-security"],"featured_image_src":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2021\/11\/email-scam.png","author_info":{"display_name":"Antoniy","author_link":"https:\/\/www.fastcomet.com\/blog\/author\/antoniy"},"yoast_head":"\nDon't Be Fooled! Recent Phishing Attacks Targeting cPanel Users<\/title>\n<meta name=\"description\" content=\"Be aware! A smart phishing scam is targeting cPanel users with a fake security advisory alerting them of high resource usage that must be resolved.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Don't Be Fooled! Recent Phishing Attacks Targeting cPanel Users\" \/>\n<meta property=\"og:description\" content=\"Be aware! A smart phishing scam is targeting cPanel users with a fake security advisory alerting them of high resource usage that must be resolved.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users\" \/>\n<meta property=\"og:site_name\" content=\"FastComet Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-19T13:43:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-05-15T13:48:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2021\/11\/email-scam.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1024\" \/>\n\t<meta property=\"og:image:height\" content=\"620\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Antoniy\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Antoniy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Don't Be Fooled! Recent Phishing Attacks Targeting cPanel Users","description":"Be aware! A smart phishing scam is targeting cPanel users with a fake security advisory alerting them of high resource usage that must be resolved.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users","og_locale":"en_US","og_type":"article","og_title":"Don't Be Fooled! Recent Phishing Attacks Targeting cPanel Users","og_description":"Be aware! A smart phishing scam is targeting cPanel users with a fake security advisory alerting them of high resource usage that must be resolved.","og_url":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users","og_site_name":"FastComet Blog","article_published_time":"2021-11-19T13:43:27+00:00","article_modified_time":"2022-05-15T13:48:20+00:00","og_image":[{"width":1024,"height":620,"url":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2021\/11\/email-scam.png","type":"image\/png"}],"author":"Antoniy","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Antoniy","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users","url":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users","name":"Don't Be Fooled! Recent Phishing Attacks Targeting cPanel Users","isPartOf":{"@id":"https:\/\/www.fastcomet.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users#primaryimage"},"image":{"@id":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users#primaryimage"},"thumbnailUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2021\/11\/email-scam.png","datePublished":"2021-11-19T13:43:27+00:00","dateModified":"2022-05-15T13:48:20+00:00","author":{"@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/9c06dae35ff0e0a3a169eeae762a08d2"},"description":"Be aware! A smart phishing scam is targeting cPanel users with a fake security advisory alerting them of high resource usage that must be resolved.","breadcrumb":{"@id":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users#primaryimage","url":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2021\/11\/email-scam.png","contentUrl":"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2021\/11\/email-scam.png","width":1024,"height":620},{"@type":"BreadcrumbList","@id":"https:\/\/www.fastcomet.com\/blog\/phishing-campaign-targets-cpanel-users#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fastcomet.com\/blog"},{"@type":"ListItem","position":2,"name":"Don’t Be Fooled! Recent Phishing Attacks Targeting cPanel Users"}]},{"@type":"WebSite","@id":"https:\/\/www.fastcomet.com\/blog\/#website","url":"https:\/\/www.fastcomet.com\/blog\/","name":"FastComet Blog","description":"FastComet Web Hosting Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fastcomet.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/9c06dae35ff0e0a3a169eeae762a08d2","name":"Antoniy","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fastcomet.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/bebc2fa14b210e2e79c8a90be5e115a9b1cae5a04fe1151f238a76958c85a8ed?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/bebc2fa14b210e2e79c8a90be5e115a9b1cae5a04fe1151f238a76958c85a8ed?s=96&d=mm&r=g","caption":"Antoniy"},"description":"Antoniy\u2019s primary goal at FastComet is helping grow our client base through affiliates and strategic partnerships. It is all about statistics analysis, communication with our affiliates, working on various campaigns, searching the web for trends and generating ideas for future projects. You're likely to run across him at some point in the FastComet Community, too because he loves getting in and interacting with our great customers. You can always count on him to come up with strategic ideas for the team and is always searching for the smartest ways to spread our brand and services worldwide.","sameAs":["https:\/\/www.fastcomet.com"],"url":"https:\/\/www.fastcomet.com\/blog\/author\/antoniy"}]}},"_links":{"self":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/6842","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/comments?post=6842"}],"version-history":[{"count":5,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/6842\/revisions"}],"predecessor-version":[{"id":7527,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/posts\/6842\/revisions\/7527"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/media\/6840"}],"wp:attachment":[{"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/media?parent=6842"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/categories?post=6842"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fastcomet.com\/blog\/wp-json\/wp\/v2\/tags?post=6842"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}