Jump to content

Warning - Spoofed Emails Re: Windows Client For Cpanel

Recommended Posts

We have had 2 reports of an email claiming to be from "info@totalchoicehosting.com"


The contents were;


The TCH staff has recently compiled its newest invention - a Windows

based client to access your cPanel account, webmail, and more.


The beta version is currently available at XX-removed-XX


-TCH Staff


Please note that this email is not from us, and DO NOT follow the link provided.

Share this post

Link to post
Share on other sites

I assume this has been reported to whom ever is hosting it?


BTW I'd welcome the link. Always fun to reverse engineer stupid programs to see what information it can provide. I've had trojans before now that contained the persons ICQ account details.

Share this post

Link to post
Share on other sites

Sent : Monday, August 13, 2007 4:59 AM

To :

Subject : [somehostingcompany] - Important: account de-activation in one week.



You can ignore this message if you have either cancelled or are no longer using

the account. We send this message as a final check to ensure you are aware of

the pending removal. This notice is sent as a final safety check before your

account is removed.


Afraid this message is fake? (fraud or phishing email)? Please go to your

account control panel. Your current status will be listed as well as update

instructions. Your control panel is at : https://cp.square.somehostingcompany.com'>https://cp.square.somehostingcompany.com






The status of the account listed below is either cancelled or unknown. Your

account will be deleted on August 15, 2007 if we do not hear from you.


Username :

Primary Domain Name :


If you are still using this account, you need to update your billing information

with us immediately.


Please follow the link below to update your billing :




This link will take you directly to the billing update page for your account. It

is important that you update your credit card information as soon as possible.


If you are unsure of the authenticity of this email, you can also log into your

control panel directly. Your control panel address is :




Your control panel username is :




Once logged in, click on Billing (top right corner of the page) then follow the

"Update Billing" link.


If you do not know your password, click the following link :




to have the password sent to you via email. If asked for your email address

enter :




somehostingcompany.com Billing Department



Frequently Asked Questions:


Why would my account status be listed as "unknown" ?


If our system has not been able to bill you for a long period, your account

status may switch to unknown. Unknown status indicates that you have not

requested your account to be cancelled, yet we have also not been able to bill




I cancelled my account, why am I getting this message?


This message is sent as a safety check in case you are still using some or all

of your account. In the past, situations have arisen in which cancelled accounts

were still in use. This message is sent as a notice to ensure that you are aware

the account is being removed from the server. If you wish your account to be

deleted, you do not need to take any further action. You will receive 2 more

copies of this message. You have not been billed. No action is needed if you do

not want to keep the cancelled account.





[ for your reference, this email was sent to : ]


(I removed my email and sorta info... Their phishing wasn't too good since the email isn't the one I use, the domain name was wrong, as well as the cpanel login. :P ) But, this is the email we should ignore, yes?

Share this post

Link to post
Share on other sites

That email is not the same, but unless you were hosted with that company (I've removed the links to them) then it is certainly something you should NOT be following.


Be careful for about anything that asks for billing information. Go to the site directly in your browser (not by following the link) and go to the billing department from there.


For us that would generally be https://ssl.totalchoicehosting.com/modern

Share this post

Link to post
Share on other sites