What to do about a suspicious login alert for cPanel or email

A suspicious login alert means that a cPanel, webmail, IMAP or SMTP session differs in some way from normal usage, such as a new IP, country, network or device. It does not prove on its own that the account has been compromised, but it is worth checking before dismissing it.

Do not log in from links in an unexpected message. Go directly to the client area or cPanel and check the affected account there.

In these alerts, SMTP identifies a login used to send email; IMAP, POP and webmail identify logins to the mailbox. The protocol helps you tell whether an app, an email client or an interactive session was involved.

If you recognise the login

An IP's location is approximate. A login may appear to come from another city or country when you use:

• A mobile network whose exit point is in another region.
• A VPN or corporate network.
• An internet provider that has changed your public IP.
• An email client or external service that connects on your behalf.
• A trip or a new device.

Compare the date, the email address or username and the type of login. If they match something you have just done, you can keep the password, although we still recommend enabling two-factor authentication in the client area.

If you do not recognise the login

1. Change the specific affected password immediately. The password for a mailbox, FTP or WordPress is separate from the cPanel password.
2. If it is cPanel, the change also replaces the main credential used by cPanel, FTP and SSH. Review additional FTP accounts separately and change only the ones you do not recognise or that may have been exposed.
3. Enable two-factor authentication in the client area.
4. Scan the computers you manage the account from with security software. Changing the password from an infected device can expose the new one too.
5. Check in Track Delivery whether the mailbox has sent messages you do not recognise, and look for unknown rules, filters and forwarders.
6. Check for recent changes to files, users, cron jobs, DNS and applications.

Use new, unique passwords. Adding a character to the old one or reusing a password from another service is not enough. The guide on how passwords are compromised explains the most common sources.

If the mailbox no longer lets you log in or send, there may be a preventive restriction. Logging in, receiving and sending are separate permissions. Review the cause and pending messages before reactivating, following the guide to unblock an account after its login details have been compromised.

When to ask for a review

Contact support if you do not recognise the login, you see outgoing email or unauthorised changes, or you cannot work out which credential was used. Give the affected account, the approximate date and the IP shown in the alert; never send the password.

We can check the login against the available logs and see whether there is related activity afterwards. An unexpected geolocation with no unusual actions may be legitimate; a known IP does not rule out a compromised credential.

Keep the context of the check

Note which login you have checked and which device or task it matches. Alerts from an app that connects in the background may repeat even if you have not opened the browser.

If you change a credential, update it on the devices you have checked and watch whether unknown connections keep appearing. A later review lets you tell attempts by an app still using the old password apart from new activity that still needs attention.