An email that asks you to click a link and enter your email password so that your mailbox isn't closed, to "release" messages or to keep your password, is a scam (phishing). We never send you such a message. If in doubt, don't click anything, log in to cPanel or the Client Area yourself to see whether there is a real issue, or forward the message to support.
Which fake messages do we see most often
Scammers copy the style of hosting, cPanel and webmail notifications. The subjects our customers forward to us look like these:
- "Your mailbox is full" or "The domain has reached their disk quota"
- "You have 5 pending incoming emails"
- "Your account will be closed" or "Your email will be deactivated, cancel the request"
- "Verify your account", "Please validate", "Email verification"
- "Security upgrade completed for your cPanel account" with a Keep My Current Password button
- "Authentication Failure Alert" with a Re-Authenticate button
- "We noticed an unusual login attempt"
- "Security update, your password expires in 3 days"
They all have the same goal. To lead you to a page that looks like webmail or cPanel and get you to type your password there. With that password they then send spam from your account or read your mail.
Is it true that my mailbox or hosting space is full?
Don't check it through the email's link. Check it yourself:
- Log in to cPanel by typing the address yourself, as described in the ways to log in to cPanel.
- Open cPanel > Email > Email Accounts. Next to each address you see how much space it uses and what its limit is.
- For the total space of the account, open cPanel's Disk Usage.
If everything is far from the limit, the email was fake. If a mailbox really is filling up, see how to increase its quota.
The server also sends real notifications, for example about space or bandwidth, to the address you have set in cPanel's Contact Information. A genuine notification informs you. It does not ask you to enter a password on some page to "save" the account.
How do I know whether an email really came from Konet
The Client Area sends you real messages, such as invoices, expiry notices, a notice about a login from a new IP address or through a VPN, and the login verification code. You receive a password reset message only if you requested it yourself from the login page. More rarely we may ask you to verify your details. Even then we ask you to log in to the Client Area and upload the documents there, not to enter a password on a page from a link.
To confirm a message that claims to be from us:
- Don't click any link in the message.
- Type billing.konet.gr in the browser yourself and log in to the Client Area.
- Open the history of emails we have sent you.
- Search for the message by its date and subject.
If the message is not in the history, we did not send it.
The signs that give away a fake email
The more of these you see, the more certain it is a scam:
- The sender has nothing to do with your domain or with us. The displayed name may say "Email Security Server" or "cPanel", but the address after the @ is unrelated.
- It puts you under time pressure. "In 5 minutes", "within 48 hours", "in 3 days".
- The button goes to a foreign domain. Hover the mouse pointer over the button without clicking. If the address is not your domain or konet.gr, it is a scam.
- It has an HTML or ZIP attachment you weren't expecting.
- It asks for a password or a one-time code (OTP).
The full list of signs and how to see the real sender in the message headers is in our article on email scams. The same applies to fake messages from banks, couriers or payment platforms. How to check a link before you click it is explained in phishing links.
Messages about my domain or site from strangers
There are also scams that don't imitate the provider but threaten the domain or the site:
- An office in China tells you that someone wants to register your name or your domain with another extension.
- A message that your domain "infringes the rights of a major brand", usually with a ZIP attachment.
- A message through your site's contact form that "Google will remove" your website.
Never reply to these messages and never open attachments. Delete them. Replying confirms that your address is active, and replying to a malicious sender can even lead to an abuse report against your own address.
Can you check whether the attachment has a virus?
No, we cannot check an attachment for viruses. The rule is simple:
- If you don't know the sender, don't open the attachment.
- If you know them but the message looks odd, call them on a number you already have and ask whether they sent it. Accounts of people you know may have been compromised.
We can, however, tell you whether a message that appears to come from us or from your server is genuine. Forward it or send us a screenshot in a support ticket.
What do I do with the fake email
- Don't click any link or button.
- Don't reply.
- If your plan includes the Professional Spam Filter (SpamExperts), mark it as spam, as described in SpamExperts Train Spam, so that the filter learns.
- Delete the message.
If you already clicked the link and entered your password, change it immediately from cPanel > Email > Email Accounts > Manage and click Update Email Settings. Then open a support ticket so that we can check whether spam was sent from your account. What to do if you gave card or e-banking details is in phishing links.
Frequently Asked Questions
Why do I keep receiving such messages on every address of the domain?
Your addresses are on spammers' lists. An incoming filter such as the Professional Spam Filter (SpamExperts) keeps most of them out of your inbox.
What do I do if a legitimate message was caught as spam?
If your plan includes the Professional Spam Filter (SpamExperts), open Incoming > Spam Quarantine in the Professional Spam Filter and choose Release and train from quarantine from the message's actions menu. If the message was delivered but marked as spam, train the filter with Train Not Spam.
Should I change my password if I'm not sure I entered it anywhere?
Change it anyway. You have nothing to lose.