A phishing email may be sent from an unrelated 3rd party posing as a reputable business to compromise the security of the account in question. This article covers how you can distinguish between legitimate emails from cPanel and spoofed emails only claiming to be from cPanel.
If the email looks suspicious, it more than likely did not come from cPanel. That said, this can be checked via the email headers. The article below covers how to locate the headers for the email.
From the email headers, you will be able to see which server sent the email. We are using Outlook for mail, so the email should come from one of the Outlook servers. An example of this is shown below.
Additionally, you will want to check that DKIM and SPF passed. Valid records should look something like the following:
If you have any doubt about whether an email claiming to be from cPanel is legitimate, please do not click on any links or open any attachments contained within the said email, as these may prove to be malicious.
If the email is known to be fraudulent and you would like to report it, you can report the offenders by forwarding the email to firstname.lastname@example.org or visiting https://apwg.org/reportphishing/. The APWG (Anti-Phishing Working Group) is the global industry, law enforcement, and government coalition focused on unifying the global response to electronic crime.