Very Tricky Phishing Attempt with full mailbox warning

In frequently I visit my spam folder, but I do know that stuff gets sent there for wrong reasons. I saw this one that looked legit as a warning from cpanel for a domain I own that my mailbox was full:

The things that seemed wrong are:

  • The email account it referenced is one that I do not have set up as an account, it is a forwarder to my email. So it has zero storage
  • This message is from one of my domains, but I never use I always go through another

I went in and found I have onl7 4 email accounts created, and none match the one in this message.

Going back to the email message and viewing the original one, I see where Google had flagged a number of the relay points as spam. But then, I found in the message, spurious links that were written to look like they were my cpanel links, but were written to some app hosted on (I checked the link in incognito browser, its not running).

Always be suspicious! And view source of links