{"id":2878,"date":"2013-10-09T23:29:35","date_gmt":"2013-10-10T03:29:35","guid":{"rendered":"https:\/\/www.inmotionhosting.com\/support\/2013\/10\/09\/phishing-scam-fatal-error-data-lost\/"},"modified":"2022-08-05T11:34:32","modified_gmt":"2022-08-05T15:34:32","slug":"phishing-scam-fatal-error-data-lost","status":"publish","type":"post","link":"https:\/\/www.inmotionhosting.com\/support\/security\/phishing-scam-fatal-error-data-lost\/","title":{"rendered":"Recent Phishing Scam: Fatal ERROR! Data lost risk"},"content":{"rendered":"

There is a recent phishing scam going around via email that is trying to trick website owners that there is an issue on their server. It then instructs them to enter in their cPanel credentials in order to resolve the problem, but it links off to a fraudulent phishing site, and not the legitimate cPanel login interface.<\/p>\n\n\n\n

Check out our guide on Avoiding Phishing Scams<\/a> for more information on protecting yourself.<\/div>\n\n\n\n

Fraudulent Email to Look Out For Claiming Fatal ERROR!<\/h2>\n\n\n\n

These are the important parts of the message to pay attention to:<\/p>\n\n\n\n

Email Header<\/h3>\n\n\n\nSubject: Fatal ERROR! Data lost risk! From: \"CPanel Network Server Monitor\" <administrator@example.com> X-Mailer: PHP<\/code>\n\n\n\n

The Subject<\/strong> will typically read Fatal ERROR! Data lost risk!<\/strong><\/p>\n\n\n\n

The From<\/strong> will typically read CPanel Network Server Monitor<\/strong> the sender will appear to be from your domain.<\/p>\n\n\n\n

The X-Mailer<\/strong> will typically read PHP<\/strong> indicating the message was directly sent from a spam script, not a mail client.<\/p>\n\n\n\n

Email Body<\/h3>\n\n\n\n

The body of the message will make it seem like there is a fatal error (usually related to MySQL) and then provide you with a URL to click on to \u201cresolve this issue\u201d.<\/p>\n\n\n\nMessage from CPanel Network Server Monitor, 10\/07\/2013 00:12:00: Item: DRIVER=MYSQL Server; MYSQL Result: Fatal ERROR! Data lost risk! Explanation: ERROR: Opening connection to database, ADO error: Unspecified error MYSQL Server does not exist or access denied. To resolve this issue, please, restart MySQL Server, using this URL: https:\/\/78.46.148.125\/cpanel\/index.php?domain=example.com&reauth=1783 <\/code>\n\n\n\n

Email URL Links to Fake cPanel<\/h3>\n\n\n\n

When you click on the URL, it takes you to what appears to be a standard cPanel login interface.<\/p>\n\n\n\n

However, pay close attention as the URL mentions index.php?domain=example.com<\/strong><\/p>\n\n\n\n

\"Fake<\/figure>\n\n\n\n

You can also see that the URL is trying to use an IP address instead of your domain name to access cPanel. This IP address is from a hacked server, and when you try to type in your cPanel credentials it\u2019s going to reject them with a password failed error.<\/p>\n\n\n\n

You\u2019ve just confirmed that your domain is example.com<\/strong> and just given up your cPanel credentials to a hacker.<\/p>\n\n\n\n

Ensuring a Proper cPanel Login<\/h2>\n\n\n\n

To ensure you\u2019re logging into your real cPanel account you can follow the steps in our login to cPanel<\/a> article.<\/p>\n\n\n\n

In your web browser\u2019s address bar if it doesn\u2019t read one of the following formats, don\u2019t login:<\/p>\n\n\n\n