A compromised mailbox is one of the most common abuse incidents we handle. The password was usually guessed, reused from a breached site, or stolen by malware on a device.
SIGNS
Bounce messages for emails you never sent Contacts reporting strange messages from your address Your account hitting sending limits unexpectedly Sending suspended by us
IMMEDIATE ACTIONS
- Change the password on that mailbox, and on every other mailbox on the account. Use new, strong, unique values.
- Update the password in every device and mail client using it, including phones.
- Check for forwarding rules and filters you did not create. Attackers frequently add a rule to forward or delete mail so you do not see replies and warnings.
- Check webmail settings for an altered signature or reply-to address.
- Scan every computer and phone that accesses the mailbox.
- Enable 2FA on cPanel.
- Reply in the ticket telling us what you found and changed.
AFTERWARDS
Your domain may have landed on email blacklists. See the delisting article. Reputation recovers over days to weeks of clean sending, so avoid bulk campaigns immediately afterwards.
