Phishing Emails from 'SSL on InMotion' no-reply@cpanel.net: Beware!

Message Content:

Verification is required for This email address is being protected from spambots. You need JavaScript enabled to view it..

Autossl has successfully renewed the Email Validated (EV) SSL certificate for
This email address is being protected from spambots. You need JavaScript enabled to view it. on the InMotion Network Server.

The new certificate lacks the secure key for your email address; This email address is being protected from spambots. You need JavaScript enabled to view it., this might lead to email deliverability and security issues.

A verification is required to use this feature for a secure and efficient mailing experience.
Verify Email Address

© 2001-2022 InMotion®, All Rights Reserved.

Raw Message Headers, for forensic analysis:

from ec2-52-23-177-170.compute-1.amazonaws.com ([52.23.177.170]:19742 helo=FEVM020000216205.localdomain) by ecngx308.inmotionhosting.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.95) (envelope-from <This email address is being protected from spambots. You need JavaScript enabled to view it.>;) id 1oRNwq-00CRTM-SW for This email address is being protected from spambots. You need JavaScript enabled to view it.; Thu, 25 Aug 2022 21:15:49 -0400
from cpanel.net ([103.156.93.66]) (user=This email address is being protected from spambots. You need JavaScript enabled to view it. mech=DIGEST-MD5 bits=0) by FEVM020000216205.localdomain with ESMTP id 27Q1FN5p023013-27Q1FN6K023013 for <This email address is being protected from spambots. You need JavaScript enabled to view it.>;; Thu, 25 Aug 2022 18:15:48 -0700

How to check if your email was fake, too:

1. Pull up the email in question using your mail program (Outlook, Thunderbird, Webmail, etc)
2. Look for the option that displays the raw message headers.  Normally this is in "View -> Headers -> All"
3. Check to see if the email addresses match the sender in "From" - in my case the "mismatch" is This email address is being protected from spambots. You need JavaScript enabled to view it. 

Edit February 2, 2023:

I received another one like this from This email address is being protected from spambots. You need JavaScript enabled to view it. but with a different subject:

SSL Certificate update for This email address is being protected from spambots. You need JavaScript enabled to view it..

InMotion SSL Verification.

We are updating our SSL Certificate for all emails on the InMotion Server.
You are required to confirm your email: This email address is being protected from spambots. You need JavaScript enabled to view it. is still active on the InMotion server.

Please confirm your email address using the link below:
Confirm email

(linked to https:// jibberish.ipfs.dweb.link/#This email address is being protected from spambots. You need JavaScript enabled to view it.)

If you have any questions, our support team is just a step away via live chat, phone, and email, Monday - Friday, 9 a.m. - 6 p.m. EST.

Thanks!
InMotion Team

Raw Message Headers:

from [59.16.217.6] (port=39618 helo=savemail.savezone.co.kr) by me.myserver.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (Exim 4.95) (envelope-from <This email address is being protected from spambots. You need JavaScript enabled to view it.>;) id 1pNeu9-0008O2-8z for This email address is being protected from spambots. You need JavaScript enabled to view it.; Thu, 02 Feb 2023 14:05:54 -0500