Fake cPanel and Webmail emails: "your mailbox is full" and other scams

What the scam looks like

The attacker knows the victim uses mail on a cPanel server because it shows in the MX records or the Webmail address. With that they craft an email that looks like a technical notice from the server itself. The most common variants:

The link leads to a page that copies the Webmail, Roundcube or cPanel login. Many load your company logo from the domain and show your address already typed in, because it travels inside the link itself. The victim only has to type the password.

How to spot a fake notice

• The sender isn't your server. Real cPanel quota notices are sent by your own server. A notice "from the mail administrator" coming from another domain is fake, even if the display name says "cPanel" or "Webmail".
• The link doesn't go to your domain. Real Webmail lives at https://webmail.yourdomain.com, https://yourdomain.com:2096 or the address your provider gave you. The copies usually sit on hacked websites, form services or cloud storage.
• They ask for your password. No quota notice needs you to sign in from a link. To check how much space you use, open Webmail by typing the address yourself.
• There is urgency. "Your account will be deactivated in 24 hours" is the typical pressure to keep you from stopping to think.
• The design mixes brands. cPanel, Roundcube and Microsoft logos in the same email, or a cPanel "version" that doesn't exist.

If you are unsure about a specific message, check its headers: the Received field shows which server it came from, and the SPF and DKIM results say whether the sending domain authorized it. We explain how in how to read email headers.

Why these emails get past filters

This phishing is designed to slip past cPanel's basic antispam:

• It is sent from real compromised accounts, with a good reputation and valid SPF and DKIM. RBLs and greylisting have nothing to object to.
• The text is short and technical, without the words that score high in SpamAssassin.
• The link points to a hacked legitimate site or a well-known service that isn't on any blocklist on the day of the attack.
• The fake page appears later. Some campaigns switch the page on hours after sending, or show harmless content to automated scanners.

That is why detecting it means analyzing where the link leads and what that page shows, not just who sent the email. More on this technique in credential phishing.

What to do if someone entered their password

Act within the first hour. The attacker usually gets into the mailbox within minutes to read mail, set up BEC fraud or send the same phishing to every contact.

1. Change the password in cPanel › Email › Email Accounts, to a new and unique one. If the same password was used elsewhere, change it there too.
2. Check the forwarders in cPanel › Email › Forwarders and delete any you don't recognize.
3. Check the account's filters in Email Filters. A filter that deletes or moves mail containing words like "invoice", "payment" or "password" is a clear sign.
4. Check the autoresponder and the signature, which some attackers change to add links.
5. See what the account sent in cPanel › Email › Track Delivery, filtering by the address.
6. Warn your contacts if the account sent mail, so they don't open the links.

If the account is already sending spam or the server IP ended up on blocklists, follow compromised email account: how to find it and stop the spam.

For administrators: finding the campaign across the server

If one person received the email, several probably did. Search for the subject in the Exim log to see who got it, and remove it from the mailboxes before someone else clicks:

# Messages received with that subject (cPanel logs the subject)
grep 'T="Your mailbox' /var/log/exim_mainlog | grep "<=" | awk '{print $3, $5}'

# Recipients of a specific message
exigrep MESSAGE_ID /var/log/exim_mainlog | grep "=>"

# Find and delete the email in a mailbox
doveadm search -u user@example.com mailbox INBOX subject "Your mailbox"
doveadm expunge -u user@example.com mailbox INBOX subject "Your mailbox"

Before deleting, check with doveadm search that the criteria only match the phishing. A subject that is too generic can match legitimate mail.

Then look for sign-ins from unusual IPs on the accounts that received the email, especially from countries where your company doesn't operate. The commands are in email brute force and password spraying.

How to prevent it

• Tell your team what real notices look like. One sentence prevents most cases: "the server will never ask for your password by email".
• Give people an easy way to report a suspicious email, such as forwarding it to an IT address.
• Enable two-factor authentication for cPanel and WHM. It doesn't cover IMAP or SMTP access, but it stops a stolen password from opening the panel.
• Limit hourly sending in WHM, so a stolen account can't send thousands of messages before you notice.
• Filter links in inbound mail with a tool that checks the landing page, which is where the scam lives.

Frequently asked questions