What to Do If Your Plesk Email Account Is Hacked/Compromised?

Step 1: Immediate Containment – Change Your Email Password

Critical Safety Note: If you suspect malware, a keylogger, or an info-stealer is present on your computer, perform this password reset from a secondary, clean device (such as a mobile phone using cellular data or a completely separate, clean computer). Changing your password from an infected machine will immediately hand the new password back to the attacker.

Option A: Log in via your Rebel Account Portal (Fastest)

1. Go to Rebel.com (or Rebel.ca) and click Account Sign In / Up in the top-right corner.
    
2. Enter your Rebel username and password. Complete the multi-factor authentication (MFA) verification code sent to your phone or backup email (ensure you do not send the verification code to the compromised email address).
    
3. Once logged in, you will land in your domain manager dashboard:
   • Rebel.com users: https://www.rebel.com/en/dashboard/products/domains 
   • Rebel.ca users: https://www.rebel.ca/en/dashboard/products/domains
      
4. At the top of the portal under Products (located beside the Rebel logo), click Hosting.
    
5. Locate your hosting subscription and click Control Panel to automatically authenticate into your Plesk dashboard.
    
6. In Plesk, click the Mail tab in the left-hand navigation menu.
    
7. Click on the affected email address.
    
8. Enter a strong, unique new password (we recommend at least 16 characters containing uppercase letters, lowercase letters, numbers, and symbols).
    
9. Confirm the password and click OK / Apply.

Option B: Log in directly to Plesk (Port 8443)

1. Format: https://canada[number].rebel.com:8443 (or the specific direct server address provided in your initial Rebel hosting manager).
    
2. Enter your Plesk administrative username and password.
    
3. Select Mail from the left-hand menu > click the mailbox name > enter a new secure password > click OK.

Step 2: Audit Mailbox Rules, Forwarders, and Autoresponders

1. In your Plesk Panel, navigate to Mail and select your mailbox name.
    
2. Check Email Forwarding:
   • Select the Email Forwarding tab.
   • If "Switch on mail forwarding" is enabled, review the destination addresses. Remove any unrecognized forwarding addresses immediately and save changes.
3. Check Auto-Reply:
   • Select the Auto-Reply tab.
   • Ensure no unauthorized out-of-office message or automated response containing phishing links or malicious attachments has been activated.
4. Audit Webmail Message Filters (Roundcube):
   • Navigate to https://webmail.yourdomain.com.
   • Log in with your email address and newly updated password.
   • Go to Settings (gear icon) > Filters.
   • Review all active filter sets. Attackers often create rules to automatically delete incoming messages, mark specific domains as read, or silently move emails to hidden folders or Trash. Delete any filter rule you did not explicitly create.

Step 3: Device Security & Malware Elimination

For Windows:

1. Run a Full Antivirus Scan:
   • Open Windows Security > select Virus & threat protection.
   • Under Scan options, choose Full scan and click Scan now.
   • Download and run a secondary, standalone scanner such as Malwarebytes for Windows to detect stealth adware, token hijackers, or rootkits that traditional scanners may overlook.
2. Audit Startup Applications:
   • Press Ctrl + Shift + Esc to open Task Manager.
   • Select the Startup apps tab on the left sidebar.
   • Review all programs configured to launch at boot. Disable any unfamiliar application, executable, or program lacking a verified publisher.
3. Inspect Active Processes:
   • Open the Processes tab in Task Manager and review background tasks showing unexplained, sustained CPU or network utilization.

For Mac (macOS):

1. Run a Dedicated Malware Scan:
   • Download and install the software using the Malwarebytes for Mac Installation Guide.
   • Run a comprehensive scan to locate and quarantine unwanted background daemons, adware payloads, and hidden launch agents.
2. Review Login Items & Background Daemons:
   • Go to System Settings > General > Login Items & Extensions.
   • Review both the Open at Login list and the Allow in the Background list. Toggle off any application, script, or developer utility you do not recognize.
3. Inspect Browser Extensions:
   • Open your installed browsers (Safari, Chrome, Firefox, Edge) and go to their respective Extensions/Add-ons managers. Remove any third-party extensions you did not intentionally install.

For Mobile Devices (iOS & Android):

• Android: Open the Google Play Store > tap your profile icon in the top-right > select Play Protect > tap Scan. Additionally, check your device application manager and uninstall any sideloaded APKs or unrecognized apps.
   
• iPhone / iPad (iOS): Open Settings > General > VPN & Device Management. Verify that no unknown configuration profiles or third-party Mobile Device Management (MDM) certificates are installed. If any unfamiliar profile exists, tap it and select Remove Profile.

Step 4: Re-authenticate Your Email Clients

• Classic Outlook for Windows: Open Outlook. When prompted by the credential dialog, enter your new password. If no prompt appears, navigate to File > Account Settings > Server Settings to update your incoming (IMAP/POP) and outgoing (SMTP) passwords (for reference, see the Microsoft guide on changing or updating email account settings in Outlook for Windows).
   
• New Outlook for Windows: Click the Settings (gear icon) in the top right > select Accounts > locate your Plesk email address and click Manage. Scroll down to the bottom of the page, click Repair, and enter your new password in both the incoming password field and the outgoing SMTP Password field. Do not modify your existing hostnames or port numbers—those settings remain untouched.
   
• Apple Mail (macOS): Open Apple Mail > go to Mail in the top menu bar > Settings > Accounts > select your mailbox > re-enter your new password in the incoming server settings and the outgoing (SMTP) server settings.
   
• Apple Mail (iOS / iPadOS): Open Settings > scroll to Apps > Mail > Mail Accounts > tap your Plesk account > enter your new password for both the incoming mail server and the primary outgoing SMTP server.
   
• Android (Gmail, Samsung Email, Outlook App): Open your email app > go to Settings > tap your account > navigate to Server settings or Incoming/Outgoing settings > update both server password fields.

Step 5: Post-Incident Checklist & Next Steps

1. Notify Key Contacts & Clients: If unauthorized spam, fake invoices, or suspicious phishing links were sent from your address during the breach, reach out to your frequent contacts, vendors, and clients. Advise them that your account experienced an unauthorized intrusion, has now been secured, and that any links, attachments, or banking/payment change requests received during the compromise window should be deleted immediately.
    
2. Audit Associated Online Services: If this email address acts as the primary recovery email for critical external platforms (such as your domain registrar, online banking, payment gateways, accounting software, or corporate portals), log in to those platforms immediately. Review recent login history, check for unauthorized password reset emails, and update your passwords across those services.
    
3. Practice Strong Password Hygiene: Never reuse passwords across multiple services or use your hosting portal password as your mailbox password. We strongly recommend using a reputable password manager (such as Bitwarden or 1Password) to generate and store randomized credentials.
    
4. Contact Rebel Support: If your domain or mailbox was temporarily rate-limited, greylisted, or suspended by our outbound mail filters due to an automated spam surge during the compromise, reach out directly to our support team once you have completed the containment steps above. Our team will document the case and coordinate directly with our hosting engineering team to perform a complete systems sweep—purging any remaining malicious messages stuck in the outbound server mail queues, verifying your DNS authentication records (SPF, DKIM, and DMARC), confirming that your domain reputation is protected, and restoring normal outbound delivery.