ALERT: Phishing Scam - GoDaddy Targetted

**RicoShay** · 06-25-2009, 12:19 AM

PHISHING ALERT: DOMAINERS BEWARE

I just received an email appearing to be from GoDaddy.com - alerting me to multiple invalid login attempts on my account. It gave a link asking me to proceed to setup extra security.
????: NamePros.com http://www.namepros.com/warnings-and-alerts/592310-alert-phishing-scam-godaddy-targetted.html

The email looks exactly like most legit emails I get from GoDaddy. But it just didn't sound right. I hovered over the link and immediately noticed it to be a hoax. It starts of like

Code:

http://godaddy.com.48673468909234902340X9238.search799.com

I clicked on it to take a closer look. I was presented with a page that looked identical to the GD login pages. Even the certificate at the bottom is faked almost to perfection. However, the domain where this page is hosted is "search799.com" (admin please remove if you find it inappropriate).

Amongst other things I found a fake Barclays Bank site also on the same domain.

WARNING: We all need to be extra vigilant, especially when clicking through links either via email or otherwise. As a rule, I always type in my registrars url manually - I never click through on a link without inspecting it first. Everyone needs to be aware of these scams. Your domains are at risk, so pay that little extra bit of attention.

Pay attention to the links, the most important part is the just before the first forward slash - right after the extension.

eg.

Code:

http://namepros.com.7897983-04.security.fakedom.com/example

in that example "fakedom.com" is the domain and not namepros.com as it might appear at first glance. Scam links generally use subdomains with names of popular sites to make it appear like its the real deal.

Btw. I'm not sure who, how or where to report this issue. Please feel free to take some action and give advice on what to do with such cases.

ddchan · 06-25-2009, 04:33 AM

Thanks for alert. I just received the same scam emails.
The whois for search799 shows:

Registrant:
Jackie Robinson
140 Marlborough Street
Henley Beach
Adelaide, South Australia 5022
Australia

Domain Name: SEARCH799.COM
Created on: 25-Nov-07
Expires on: 25-Nov-09
Last Updated on: 16-Jun-09

Administrative Contact:
Robinson, Jackie
140 Marlborough Street
Henley Beach
Adelaide, South Australia 5022
Australia
(088) 356-6285 Fax --

email jackie_e_ryan@hotmail.com

bmugford · 06-25-2009, 07:11 AM

I just received about 10 of the exact same emails. The first giveaway was that the email came to my whois email, which is different than my account email. The link pointed to cyber-edge.com, which is registered on GoDaddy using Domains By Proxy, pretty ironic.

I would like to report this but have no idea who to report it to.

Brad

**RicoShay** · 06-25-2009, 10:58 AM

Originally Posted by bmugford

I just received about 10 of the exact same emails. The first giveaway was that the email came to my whois email, which is different than my account email. The link pointed to cyber-edge.com, which is registered on GoDaddy using Domains By Proxy, pretty ironic.
????: NamePros.com http://www.namepros.com/showthread.php?t=592310

I would like to report this but have no idea who to report it to.

Brad

So, its quite common then. Just as I feared.

I've no clue how to go about reporting it either. I'm surprised there's not been much response here.

ddchan, nice work with the whois info lol.

Would be nice to get more input here.
This is quite a serious issue.

shane mac · 06-25-2009, 01:41 PM

I would send godaddy a mail.They should be made aware.

turnhardtoeasy · 06-25-2009, 01:56 PM

i think the websites are removed now...
ny wasy thanks for updating us regarding the issue

somebody_rb · 08-29-2009, 07:21 AM

thanks for the alert

06-25-2009, 12:19 AM	THREAD STARTER #1 (permalink)
RicoShay www.demonised.com Join Date: May 2007 Location: London (UK) Posts: 2,956	ALERT: Phishing Scam - GoDaddy Targetted PHISHING ALERT: DOMAINERS BEWARE I just received an email appearing to be from GoDaddy.com - alerting me to multiple invalid login attempts on my account. It gave a link asking me to proceed to setup extra security. ????: NamePros.com http://www.namepros.com/warnings-and-alerts/592310-alert-phishing-scam-godaddy-targetted.html The email looks exactly like most legit emails I get from GoDaddy. But it just didn't sound right. I hovered over the link and immediately noticed it to be a hoax. It starts of like Code: http://godaddy.com.48673468909234902340X9238.search799.com I clicked on it to take a closer look. I was presented with a page that looked identical to the GD login pages. Even the certificate at the bottom is faked almost to perfection. However, the domain where this page is hosted is "search799.com" (admin please remove if you find it inappropriate). Amongst other things I found a fake Barclays Bank site also on the same domain. WARNING: We all need to be extra vigilant, especially when clicking through links either via email or otherwise. As a rule, I always type in my registrars url manually - I never click through on a link without inspecting it first. Everyone needs to be aware of these scams. Your domains are at risk, so pay that little extra bit of attention. Pay attention to the links, the most important part is the just before the first forward slash - right after the extension. eg. Code: http://namepros.com.7897983-04.security.fakedom.com/example in that example "fakedom.com" is the domain and not namepros.com as it might appear at first glance. Scam links generally use subdomains with names of popular sites to make it appear like its the real deal. Btw. I'm not sure who, how or where to report this issue. Please feel free to take some action and give advice on what to do with such cases. __________________ eBay FOR SALE @ NamePros: TDJ.in + RLI.in + EDE.in + ATJ.in + more \| NEW YEARS SALE - Upto 40% OFF!

06-25-2009, 07:11 AM	#3 (permalink)
bmugford www.DataCube.com Join Date: Apr 2007 Location: USA Posts: 5,819	I just received about 10 of the exact same emails. The first giveaway was that the email came to my whois email, which is different than my account email. The link pointed to cyber-edge.com, which is registered on GoDaddy using Domains By Proxy, pretty ironic. I would like to report this but have no idea who to report it to. Brad __________________ DataCube.com - Buy and Sell Premium Domains Add Me on Facebook

06-25-2009, 01:56 PM	#6 (permalink)
turnhardtoeasy Senior Member Join Date: Mar 2009 Location: India Posts: 1,750 Follow @turnhardtoeasy	i think the websites are removed now... ny wasy thanks for updating us regarding the issue __________________ blogvisit.com Makeseoeasy.com

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Many names for sale $1 to $270	ssamriga	Domains For Sale - Fixed Price	6	08-21-2009 10:25 AM
73 Domains for Sale Check it out (Fixed Price)	Smiler	Domains For Sale - Fixed Price	5	06-25-2008 10:01 AM
Great Domains sale Com/Org/Mobi/Biz/Info	uber	Domains For Sale - Make Offer	1	07-05-2007 12:11 PM
<<< 1/2 Price Sale thru Sunday >>>	yandig	Domains For Sale - Make Offer	1	05-14-2006 07:04 PM

06-25-2009, 04:33 AM	#2 (permalink)
ddchan NamePros Regular Join Date: Mar 2007 Posts: 680	Thanks for alert. I just received the same scam emails. The whois for search799 shows: Registrant: Jackie Robinson 140 Marlborough Street Henley Beach Adelaide, South Australia 5022 Australia Domain Name: SEARCH799.COM Created on: 25-Nov-07 Expires on: 25-Nov-09 Last Updated on: 16-Jun-09 Administrative Contact: Robinson, Jackie 140 Marlborough Street Henley Beach Adelaide, South Australia 5022 Australia (088) 356-6285 Fax -- email jackie_e_ryan@hotmail.com

06-25-2009, 01:41 PM	#5 (permalink)
shane mac Senior Member Join Date: May 2009 Location: Uk Posts: 1,028	I would send godaddy a mail.They should be made aware.

08-29-2009, 07:21 AM	#7 (permalink)
somebody_rb Account Suspended Join Date: Aug 2009 Posts: 76	thanks for the alert

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)