Recognise fake cPanel, webmail and low disk space notices

Reviewed on September 8, 2026 2 min read phishing fraud

An email can imitate a cPanel or webmail notice and ask you to confirm your password to avoid a suspension, free up space or upgrade the service. If it takes you to a fake page, the attacker can obtain whatever you enter.

A convincing appearance does not prove it is legitimate. Neither does the customer's name, the cPanel username or a visible sender address: they can all be copied or forged.

Check the notice

Go in by typing core.hostsuar.com into your browser or using your usual bookmark. Check the service there and, if relevant, open cPanel from the corresponding account. A full quota can be real; check it in the panel without using the link in the message.

Read the full domain before entering any details. A padlock only shows an encrypted connection to that site; it does not prove it belongs to Hostsuar. If you cannot find the notice or are not sure how to interpret it, send us the original email from a ticket opened through the usual channel, without passwords.

What to do depending on what happened

Situation	Action
You only received the message	Mark it as spam; do not open its links or attachments
You opened the link without entering details	Close the page and check whether it downloaded files or you granted permissions
You entered a password	Change it immediately from a trusted device; also change any reused passwords and check sessions, filters and forwarders
You gave a two-factor code or authorised a session	Revoke access and check the account: the code may have been used at that moment
You opened or ran a suspicious file	Isolate the device and request a review; use another trusted device to recover access

If you interacted with it, keep the message and its headers for the investigation. Deleting the email or enabling 2FA afterwards is not enough: check what changes the attacker may have made. See how to act on suspicious access.