Remove “cPanel – Needs More Disk Space” phishing email

The “cPanel – Needs More Disk Space” email scam is a phishing campaign that attempts to obtain email account passwords by offering additional mailbox storage. The phishing emails impersonate cPanel, a legitimate web hosting management platform, and claim that the recipient’s email server is running out of disk space. The supposed storage problem is used to persuade recipients to complete an account verification process on a phishing website.

 

 

The phishing emails may have a subject line resembling “Hello, – Mail Server Needs More Disk Space.” They warn that the account has insufficient storage capacity and that incoming emails could soon be returned to their senders. The warning is particularly concerning because it suggests that important communications may be lost unless the recipient takes action.

Rather than simply requesting that users delete unnecessary emails, the phishing emails offer an additional 15 GB of storage at no stated cost. Recipients are told that they can unlock the extra capacity by confirming ownership of their email accounts. A button labeled “VERIFY ACCOUNT” is included, accompanied by a warning that the verification link will expire within 48 hours.

The phishing emails also contain cPanel branding, copyright information, and company contact details to create the appearance of an official service notification. They even instruct recipients to move the email to their inbox if it arrives in the spam folder. These elements are intended to make the phishing attempt appear trustworthy and increase the likelihood that recipients will interact with it.

The verification button leads to a phishing website designed to steal login credentials. One observed version of the website displayed a counterfeit Google sign-in window in Dutch, positioned over a page resembling a Google consent screen. The phishing website can adapt its appearance based on the visitor’s email provider, allowing it to imitate different login services.

For example, users with Gmail addresses may encounter a fake Google authentication interface, while those using other email providers may see different login pages. Some versions of the phishing attempt also direct recipients to counterfeit cPanel webmail login forms. Regardless of the displayed branding, the purpose is to obtain the email address and password entered by the visitor.

Stolen credentials could enable scammers to access private emails, obtain sensitive information, and impersonate the account owner. Attackers might also use the compromised mailbox to reset passwords for other online services or distribute additional phishing emails. The legitimate cPanel company is not involved in this campaign, and the supposed storage expansion is merely a pretext for credential theft.

The full “cPanel – Needs More Disk Space” phishing email is below:

Subject: Hello, – Mail Server Needs More Disk Space

– Needs More Disk Space

Hello -,

It looks like your email storage is running low. Pending important inboxes are currently at risk of being bounced back to the sender.

Don’t lose access to critical communications. To help you manage your storage, we are offering you the ability to instantly expand with an extra 15GB disk space.

Simply verify your account to confirm ownership and unlock this extra capacity immediately.

[VERIFY ACCOUNT]

If this arrives in your spam folder, kindly move to inbox to allow propagation. This link will expire in 48 hours.

© 2026 cPanel International, Ltd. All rights reserved.

1100 West 23rd Street, Suite 153 Houston, TX 77008

cPanel.net

How to recognize phishing emails

Phishing emails involving mailbox storage problems often exploit concerns about interrupted communication or lost emails. In this campaign, the warning that incoming emails may be returned to their senders is combined with an offer of 15 GB of additional storage. This combination of a technical problem and an attractive solution is a notable characteristic of the phishing attempt.

The requirement to verify account ownership before receiving additional storage is another warning sign. Although legitimate hosting providers may notify customers about storage limits, an unexpected email directing users to an external login page should be examined carefully. A storage upgrade offer does not establish that the recipient’s mailbox is actually approaching its capacity.

The 48-hour deadline is also intended to influence the recipient’s decision. By claiming that the verification link will soon expire, the phishing email creates pressure to act before checking the information. The instruction to move the email out of the spam folder is particularly suspicious, as it encourages recipients to disregard a potential warning from their email service.

Recipients should examine the sender’s actual email address and the destination of the verification button. Phishing emails can display legitimate company names, addresses, and logos while linking to unrelated websites. Even a login page that closely resembles Google or cPanel may be counterfeit if it is hosted outside the legitimate provider’s domain.

Another important detail is the phishing website’s ability to display different login interfaces depending on the email address used. This means that familiar branding on the destination page does not necessarily confirm its authenticity. The website address and the circumstances leading to the login request are more reliable indicators than the appearance of the page.