Another GoDaddy ICANN scam

cmason · 02-20-2011, 09:11 AM

Hi folks,

Just wanted to draw attention to yet ANOTHER GoDaddy ICANN update email scam. This morning I received an email seemingly looking like the GoDaddy ICANN updates. As I get these often and have know that some of them are scams (phishing), I never click links from the emails.

Everything looks like it is from GoDaddy, but the link they are trying to get you to click goes to a newly registered (Feb 21, 2011) domain (GoldadidyDOTcom).

DO NOT CLICK THE LINKS!!!

The domain is registered to a Joe Walters (probably fake) with an admin email of omid.hamidATRocketMail

DN_Hunter · 02-20-2011, 09:19 AM

I literally just received the same scam email (same false link too).

The funny thing is it was for a domain name I no longer own (sold it a few months ago).

ninjadomain · 02-20-2011, 09:29 AM

I received the same thing in my junk folder.

I just deleted as I always keep my information updated.

I've also received them from Moniker. Has anyone else received from Moniker?

silentg · 02-20-2011, 10:08 AM

Forward the emails to abuse@GoDaddy.com

domainsusi · 02-20-2011, 11:12 AM

I was just about to post this - already deleted three of these today.
Good idea to forward them - will try to remember that.
I surely don't want to go through the worry and hassle of reclaiming my domains again.

After I got my domains back earlier this month, I never heard another word about it from Godaddy.

Does anyone know if Godaddy takes action against these creeps?

dWhite · 02-20-2011, 12:25 PM

Originally Posted by domainsusi

Does anyone know if Godaddy takes action against these creeps?

Godaddy can't do anything against the person if he/she is living in a country where no laws exist for such things.

*RevolutionaryDomains* · 02-20-2011, 07:20 PM

I too received a similar email today.

The email had some bogus GoDaddy links and sales jargon, as if to look like it was sent direct from GoDaddy. For those who like to disect such crapola, I've included the message source details below.

-Regards

--------------------------------------
Status: U
Return-Path: <confirm@perpetualtrafficformulax.com>
Received: from aaron.mail.atl.earthlink.net ([207.69.200.106])
by mdl-ignite.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1pRbhS2hO3Nl3770; Sun, 20 Feb 2011 10:33:28 -0500 (EST)
Received: from perpetualtrafficformulax.com ([173.0.61.231])
by aaron.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id 1pRbhS1HR3Nl3qa0
for <>; Sun, 20 Feb 2011 10:33:28 -0500 (EST)
Received: from 109.230.217.140 (unknown [109.230.217.140])
by perpetualtrafficformulax.com (Postfix) with ESMTP id 75737BDE0D83
for <>; Sun, 20 Feb 2011 18:34:00 +0300 (MSK)
From: "Tim Jones" <confirm@perpetualtrafficformulax.com>
To: "" <>
Subject: [URGENT]Domain Registered In November
Date: Sun, 20 Feb 2011 07:33:25 -0800
Organization: Tim Jones
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0000_01C6527E.AE8904D0"
Message-Id: <20110220153400.75737BDE0D83@perpetualtrafficformu lax.com>
X-ELNK-Received-Info: spv=0;
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=0b; sbw=000;
????: NamePros.com http://www.namepros.com/warnings-and-alerts/703304-another-godaddy-icann-scam.html

This is a multi-part message in MIME format.

------=_NextPart_000_0000_01C6527E.AE8904D0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: 8bit

You registered a domain name in November, 2010.
Please visit CLICK HERE NOW for information.
Thanks
------=_NextPart_000_0000_01C6527E.AE8904D0
Content-Type: text/html;
charset="utf-8"

<HTML>
<HEAD>
<META NAME="GENERATOR" Content="Microsoft DHTML Editing Control">
</HEAD>
<BODY>
You registered a domain name in November, 2010.
Please visit <A
href="http://bizkill.gsniper.hop.clickbank.net/">CLICK HERE
NOW</A> for information.
Thanks
</BODY>
</HTML>
------=_NextPart_000_0000_01C6527E.AE8904D0--

--------------------------------

nielsencl · 02-21-2011, 01:14 PM

Report the spam to their hosting company and domain registrar. You can report to Godaddy, but if they are not involved, they don't have to do anything. Spam reports can be very effective against scams like this.

cmason · 02-21-2011, 01:17 PM

Originally Posted by nielsencl

Report the spam to their hosting company and domain registrar. You can report to Godaddy, but if they are not involved, they don't have to do anything. Spam reports can be very effective against scams like this.

I had done so right away to three separate parties and sadly I heard back from NONE. I understand it was the weekend and all, but usually there is support around on weekends.

Needless-to-say, I'm not overly concerned because it didn't directly hit me, but it seems that each time this phishing technique is used there a good handful of people that fall for it.

cmason · 03-07-2011, 06:18 AM

Just got another phishing email...this time with the domain Goli Daddy.com.

Look out, folks!

randomo · 03-07-2011, 06:48 AM

Originally Posted by cmason

Just got another phishing email...this time with the domain Goli Daddy.com.

Look out, folks!

Yes, I got that same one - but at least my email program was smart enough to put it in the spam folder!

silentg · 03-07-2011, 08:24 AM

This time the domain is registered with Melbourneit.com. Report this scam to them.

ninjadomain · 03-07-2011, 09:12 AM

I received the same email. The best thing to do is delete any email of the kind. Just make sure you keep your information current and there is never a need to click on any of these links.

silentg · 03-07-2011, 09:59 AM

Deleting the email doesn't solve the problem. It should be reported to the reseller. domains-support@cc.yahoo-inc.com

ninjadomain · 03-07-2011, 10:27 AM

Originally Posted by silentg

Deleting the email doesn't solve the problem. It should be reported to the reseller. domains-support@cc.yahoo-inc.com

Reporting is always a good idea.

biggie · 03-07-2011, 01:50 PM

Originally Posted by cmason

it seems that each time this phishing technique is used there a good handful of people that fall for it.

and that is what they hope for
????: NamePros.com http://www.namepros.com/showthread.php?t=703304

from what i see, most members here love gobdaddy and the scammers do too.

with each newbie that joins np, everyone tells them GD is best registrar

then they go reg and buy names at GD and next thing you know....they get their names stolen.

but it ain't just the newbie's, some veteran domainers get caught off-guard too.

keep your eyes open

silentg · 03-09-2011, 07:25 AM

Golidaddy domain is still live so beware. Avoid Yahoo Domains and MelbourneIT. I have sent numerous emails and they don't seem to take any action.

nielsencl · 03-09-2011, 07:41 AM

If you want to fight this scam, report the emails to the hosting provider of the domain and also the registrar for the domain. I agree that Melbourneit.com is one registrar that does not seem to care about spam or scams from what I have seen. They have never responded to any of my reports and I don't see that they have ever taken any action against spammers.

NameCheap.com is another registrar that is spammer-friendly in my opinion. I say this because most registrars and all hosting providers will take spam reports with headers from users like us, investigate, and take action if the report seems valid. NameCheap says the reports must be from an "authorized" source like Spamcop.net and won't investigate any of my reports. Perhaps someone can tell my how I can become "authorized"...???? I like Namecheap and I don't really think they are "spam friendly", but their policies make them appear that they are. It's one of the reasons I am moving all my domains away from them.
????: NamePros.com http://www.namepros.com/showthread.php?t=703304

The other thing you can do is find a blog post or forum that doesn't have messages about this scam and post or comment about it.

This scam cannot be stopped by reporting the scam. This scam can only be stopped by many, many people posting about it in as many places as possible, and reporting the scam emails as SPAM whenever you get one. The other thing that will help is to urge anyone that was scammed to get their money back from they payment provider. I have already posted how to do this several times and as people have posted, IT WORKS!

silentg · 03-09-2011, 09:18 AM

I got a reply from Yahoo Domains regarding Golidaddy and they said that they have taken appropriate action. The phishing website is still active at the time of this post. What a joke.

cmason · 04-18-2011, 12:55 PM

Not to rehash this yet again, but if it prevents a single member from getting phished, it was worth it!

Just got ANOTHER "Important ICANN Notice Regarding Your Domain Name(s)" phishing email. This time it was from goldidaddy. I have reported it to Yahoo Domains as well as GoDaddy. The domain was registered today.

silentg · 04-18-2011, 01:35 PM

The e-mails are being sent out again. Report it to domain.tech@yahoo-inc.com

Kamikaze · 04-18-2011, 10:38 PM

I've just got the GD scam...
Was about to write it on NP so people would beware, then found this thread on top

Damn scammers!

02-20-2011, 09:11 AM	THREAD STARTER #1 (permalink)
cmason Senior Member Join Date: Apr 2009 Location: Canada Posts: 1,276 Follow @ColeMason	Another GoDaddy ICANN scam Hi folks, Just wanted to draw attention to yet ANOTHER GoDaddy ICANN update email scam. This morning I received an email seemingly looking like the GoDaddy ICANN updates. As I get these often and have know that some of them are scams (phishing), I never click links from the emails. Everything looks like it is from GoDaddy, but the link they are trying to get you to click goes to a newly registered (Feb 21, 2011) domain (GoldadidyDOTcom). DO NOT CLICK THE LINKS!!! The domain is registered to a Joe Walters (probably fake) with an admin email of omid.hamidATRocketMail

02-20-2011, 09:19 AM	#2 (permalink)
DN_Hunter NamePros Regular Join Date: Aug 2008 Posts: 427	I literally just received the same scam email (same false link too). The funny thing is it was for a domain name I no longer own (sold it a few months ago). __________________ NOTE 1: Listings are in multiple places, so time stamp gets priority. NOTE 2: Offers to BUY or SELL are good for 24 hours from time of initial offer.

02-20-2011, 09:29 AM	#3 (permalink)
ninjadomain Senior Member Join Date: Mar 2010 Location: US Posts: 2,638 Follow @ninjadomain	I received the same thing in my junk folder. I just deleted as I always keep my information updated. I've also received them from Moniker. Has anyone else received from Moniker? __________________ Ninja Domain 342.net \| Y00.com Crew.net \| BpB.net

02-20-2011, 10:08 AM	#4 (permalink)
silentg Senior Member Join Date: Mar 2010 Location: ariyas.com Posts: 1,394 Follow @domainsg	Forward the emails to abuse@GoDaddy.com __________________ █ Makeup Games Funny Gags - Free Education Online- Cooking Games

02-20-2011, 11:12 AM	#5 (permalink)
domainsusi Senior Member Join Date: May 2004 Posts: 2,917	I was just about to post this - already deleted three of these today. Good idea to forward them - will try to remember that. I surely don't want to go through the worry and hassle of reclaiming my domains again. After I got my domains back earlier this month, I never heard another word about it from Godaddy. Does anyone know if Godaddy takes action against these creeps? __________________ Free Legal Forms

02-20-2011, 07:20 PM	#7 (permalink)
RevolutionaryDomains Never a Dull Moment Join Date: May 2009 Location: Supdu.com Posts: 1,351	I too received a similar email today. The email had some bogus GoDaddy links and sales jargon, as if to look like it was sent direct from GoDaddy. For those who like to disect such crapola, I've included the message source details below. -Regards -------------------------------------- Status: U Return-Path: <confirm@perpetualtrafficformulax.com> Received: from aaron.mail.atl.earthlink.net ([207.69.200.106]) by mdl-ignite.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1pRbhS2hO3Nl3770; Sun, 20 Feb 2011 10:33:28 -0500 (EST) Received: from perpetualtrafficformulax.com ([173.0.61.231]) by aaron.mail.atl.earthlink.net (EarthLink SMTP Server) with ESMTP id 1pRbhS1HR3Nl3qa0 for <>; Sun, 20 Feb 2011 10:33:28 -0500 (EST) Received: from 109.230.217.140 (unknown [109.230.217.140]) by perpetualtrafficformulax.com (Postfix) with ESMTP id 75737BDE0D83 for <>; Sun, 20 Feb 2011 18:34:00 +0300 (MSK) From: "Tim Jones" <confirm@perpetualtrafficformulax.com> To: "" <> Subject: [URGENT]Domain Registered In November Date: Sun, 20 Feb 2011 07:33:25 -0800 Organization: Tim Jones MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0000_01C6527E.AE8904D0" Message-Id: <20110220153400.75737BDE0D83@perpetualtrafficformu lax.com> X-ELNK-Received-Info: spv=0; X-ELNK-AV: 0 X-ELNK-Info: sbv=0; sbrc=.0; sbf=0b; sbw=000; ????: NamePros.com http://www.namepros.com/warnings-and-alerts/703304-another-godaddy-icann-scam.html This is a multi-part message in MIME format. ------=_NextPart_000_0000_01C6527E.AE8904D0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit You registered a domain name in November, 2010. Please visit CLICK HERE NOW for information. Thanks ------=_NextPart_000_0000_01C6527E.AE8904D0 Content-Type: text/html; charset="utf-8" <HTML> <HEAD> <META NAME="GENERATOR" Content="Microsoft DHTML Editing Control"> </HEAD> <BODY> <P>You registered a domain name in November, 2010.</P> <P>Please visit <A href="http://bizkill.gsniper.hop.clickbank.net/"><STRONG>CLICK HERE NOW</STRONG></A> for information.</P> <P>Thanks</P> </BODY> </HTML> ------=_NextPart_000_0000_01C6527E.AE8904D0-- --------------------------------

02-21-2011, 01:14 PM	#8 (permalink)
nielsencl Senior Member Join Date: Jul 2006 Location: Minneapolis Posts: 2,516	Report the spam to their hosting company and domain registrar. You can report to Godaddy, but if they are not involved, they don't have to do anything. Spam reports can be very effective against scams like this.

03-07-2011, 06:18 AM	THREAD STARTER #10 (permalink)
cmason Senior Member Join Date: Apr 2009 Location: Canada Posts: 1,276 Follow @ColeMason	Just got another phishing email...this time with the domain Goli Daddy.com. Look out, folks!

03-07-2011, 08:24 AM	#12 (permalink)
silentg Senior Member Join Date: Mar 2010 Location: ariyas.com Posts: 1,394 Follow @domainsg	This time the domain is registered with Melbourneit.com. Report this scam to them. __________________ █ Makeup Games Funny Gags - Free Education Online- Cooking Games

03-07-2011, 09:12 AM	#13 (permalink)
ninjadomain Senior Member Join Date: Mar 2010 Location: US Posts: 2,638 Follow @ninjadomain	I received the same email. The best thing to do is delete any email of the kind. Just make sure you keep your information current and there is never a need to click on any of these links. __________________ Ninja Domain 342.net \| Y00.com Crew.net \| BpB.net

03-07-2011, 09:59 AM	#14 (permalink)
silentg Senior Member Join Date: Mar 2010 Location: ariyas.com Posts: 1,394 Follow @domainsg	Deleting the email doesn't solve the problem. It should be reported to the reseller. domains-support@cc.yahoo-inc.com __________________ █ Makeup Games Funny Gags - Free Education Online- Cooking Games

03-09-2011, 07:25 AM	#17 (permalink)
silentg Senior Member Join Date: Mar 2010 Location: ariyas.com Posts: 1,394 Follow @domainsg	Golidaddy domain is still live so beware. Avoid Yahoo Domains and MelbourneIT. I have sent numerous emails and they don't seem to take any action. __________________ █ Makeup Games Funny Gags - Free Education Online- Cooking Games

03-09-2011, 07:41 AM	#18 (permalink)
nielsencl Senior Member Join Date: Jul 2006 Location: Minneapolis Posts: 2,516	If you want to fight this scam, report the emails to the hosting provider of the domain and also the registrar for the domain. I agree that Melbourneit.com is one registrar that does not seem to care about spam or scams from what I have seen. They have never responded to any of my reports and I don't see that they have ever taken any action against spammers. NameCheap.com is another registrar that is spammer-friendly in my opinion. I say this because most registrars and all hosting providers will take spam reports with headers from users like us, investigate, and take action if the report seems valid. NameCheap says the reports must be from an "authorized" source like Spamcop.net and won't investigate any of my reports. Perhaps someone can tell my how I can become "authorized"...???? I like Namecheap and I don't really think they are "spam friendly", but their policies make them appear that they are. It's one of the reasons I am moving all my domains away from them. ????: NamePros.com http://www.namepros.com/showthread.php?t=703304 The other thing you can do is find a blog post or forum that doesn't have messages about this scam and post or comment about it. This scam cannot be stopped by reporting the scam. This scam can only be stopped by many, many people posting about it in as many places as possible, and reporting the scam emails as SPAM whenever you get one. The other thing that will help is to urge anyone that was scammed to get their money back from they payment provider. I have already posted how to do this several times and as people have posted, IT WORKS! __________________ Lorraine Bowman - Internet Expert Witness - Bankrupture - Ad Creation Marketplace - How To Sell Domain Name

03-09-2011, 09:18 AM	#19 (permalink)
silentg Senior Member Join Date: Mar 2010 Location: ariyas.com Posts: 1,394 Follow @domainsg	I got a reply from Yahoo Domains regarding Golidaddy and they said that they have taken appropriate action. The phishing website is still active at the time of this post. What a joke. __________________ █ Makeup Games Funny Gags - Free Education Online- Cooking Games

04-18-2011, 12:55 PM	THREAD STARTER #20 (permalink)
cmason Senior Member Join Date: Apr 2009 Location: Canada Posts: 1,276 Follow @ColeMason	Not to rehash this yet again, but if it prevents a single member from getting phished, it was worth it! Just got ANOTHER "Important ICANN Notice Regarding Your Domain Name(s)" phishing email. This time it was from goldidaddy. I have reported it to Yahoo Domains as well as GoDaddy. The domain was registered today.

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

04-18-2011, 01:35 PM	#21 (permalink)
silentg Senior Member Join Date: Mar 2010 Location: ariyas.com Posts: 1,394 Follow @domainsg	The e-mails are being sent out again. Report it to domain.tech@yahoo-inc.com __________________ █ Makeup Games Funny Gags - Free Education Online- Cooking Games

04-18-2011, 10:38 PM	#22 (permalink)
Kamikaze lan.guag.es Join Date: Aug 2005 Location: Israel Posts: 818 Follow @vallerius	I've just got the GD scam... Was about to write it on NP so people would beware, then found this thread on top Damn scammers! __________________

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
geriatricians.info ElectronicBusiness.info exempts.info RazorBlades.info & much more	refide46	Domains For Sale - Auctions	2	11-14-2010 12:10 PM
geriatricians.info ElectronicBusiness.info exempts.info RazorBlades.info & much more	refide46	Domains For Sale - Auctions	2	10-26-2010 06:28 AM
USToys.co.uk HubbleTelescope.co.uk AccountExecutive.co.uk and much more!	TrueGift	Domains For Sale - Fixed Price	28	09-04-2010 07:21 PM
TigerVentureCapital.com TigerSecurities.com TreasuryBondFund.com and much more!	TrueGift	Domains For Sale - Fixed Price	30	05-30-2010 04:43 PM