GoDaddy WHOIS Verification Email - Beware of Phishing Scam

ImageAuthors · Jan 4, 2014

Please bump this thread to the top in order to warn people.

BEWARE OF THIS PHISHING SCHEME:

Beware of emails ostensibly from "GoDaddy" with titles like this:

ACTION REQUIRED - Reminder to verify the accuracy of Whois data

Despite the GoDaddy logo and graphics, this appears to be a phishing scam.

You will be directed to a GoDaddy clone website on a domain such as this one:

GoDaddyAuthentication.com

You are prompted to log in, and I'm guessing your password will be used later on to steal your domains.

GoDaddyAuthentication.com shows the following in Whois:

Domain Name: GODADDYAUTHENTICATION.COM
Registrar: NAMEBAY
Whois Server: whois.namebay.com
Referral URL: http://www.namebay.com
Name Server: NS1.ISPFR.NET
Name Server: NS2.ISPFR.NET
Status: ok
Updated Date: 04-jan-2014
Creation Date: 04-jan-2014
Expiration Date: 04-jan-2015
godaddyauthentication.com registrar whois
Updated 1 second ago
Domain Name : GODADDYAUTHENTICATION.COM
Created On : 2014-01-04
Expiration Date : 2015-01-04
Status : ACTIVE
Registrant Name : denis Alain
Registrant Street1 : 26 rue auguste blanche
Registrant City : puteaux
Registrant State/Province :
Registrant Postal Code : 92800
Registrant Country : FR
Admin Name : NUXIT
Admin Street1 : 400 avenue Roumanille
Admin City : Sophia Antipolis
Admin State/Province : FR
Admin Postal Code : 06903
Admin Country : FR
Admin Phone : +33.899563600
Admin Email : [email protected]
Tech Name : NUXIT
Tech Street1 : 400 avenue Roumanille
Tech City : Sophia Antipolis
Tech State/Province : FR
Tech Postal Code : 06903
Tech Country : FR
Tech Phone : +33.899563600
Tech Email : [email protected]
Billing Name : NUXIT
Billing Street1 : 400 avenue Roumanille
Billing City : Sophia Antipolis
Billing State/Province : FR
Billing Postal Code : 06903
Billing Country : FR
Billing Phone : +33.899563600
Billing Email : [email protected]
Name Server : NS1.ISPFR.NET
Name Server : NS2.ISPFR.NET
Registrar Name : Namebay

DNabc · Jan 4, 2014

Even for them it's better to use the "remember me" option, and save the confirmation info on a cookie at our computer, than sending a new text message everytime we login.

Archangel · Jan 4, 2014

I regged 2 domains (for a project of mine) & was told both After regging the 1st, I got this:

Dear Valued GoDaddy Customer,

We noticed that you need to verify your email address. To do so, simply click the button below. Without timely verification, you can't fully manage your domain, and we'll be required to put any hosted content on hold.

This doesn't sound very professional. It says it was sent by support@godaddy but I haven't looked in the head to verify it. Funny: this was sent about 1 min after the reg, but I wasn't given a similar email after the 2nd reg. I'm not saying this is a phishing thing but it's suspicious, as I've registered well over 100 domains in my life and had never received an email like this. I'll refrain from clicking on the link in it. I've read too many stories lately of ppl getting hacked.

Anyone else get this email?

DNabc · Jan 5, 2014

If they don't ask you to login, and you haven't verified your email this year, then it's correct. Just make sure the website is really Godaddy.com

You only have to verify your email address once.

This just started in 2014

http://support.godaddy.com/help/article/8948/verifying-contact-information-for-icann-validation

We teach people that it isn't safe to click on email links and now they make this mandatory or the domain will be suspended?

-EM- · Jan 5, 2014

Remember, all the godaddy emails will have a direct user name + surname of the respective customer opening email!
Correct:
Dear Name Surname

Scam:
Dear user,
Dear customer,
Dear godaddy customer,
etc

DNabc · Jan 5, 2014

That can be easily done, especially if they are targetting less people but with lots of names.

-EM- · Jan 5, 2014

DNabc said:
That can be easily done, especially if they are targetting less people but with lots of names.

Normally, these emails are sent to many people by using email lists
It takes more time and knowledge to make custom emails per user, and it hasn't been done till now.
Just curious, check the email you received and see how is it.

DNabc · Jan 5, 2014

This one has the generic dear customer as you said, but adding the correct name is just a matter of adding a new column to the csv before importing.
Next time they may be smarter...
The best way is to verify the url of the website when we are already there, because even an email link can be forged.

Joseph Green · Jan 5, 2014

The real verification email from Go Daddy does NOT ask you to "LOG IN TO CONFIRM"

You simply click the link in the email and then close your browser. Never log in to a site from a link in an email.

Another way to verify that you're dealing with Go Daddy is to add "https://" in front of the URL instead of "http://" like this:

AEProgram · Jan 5, 2014

here is a general tip as well given we are talking about security. The email listed in your whois should not be the email belonging to your account admin. This wont prevent you from falling for a phishing scam but help with general hacking attempts.

Ms Domainer · Jan 5, 2014

*

I regged one new domain last night and one today.

I did NOT receive the verification email for either one.

I'm wondering if GD decided to scrap that verification plan for now.

The one I regged last night is fully operational now.

If you have gmail, there is a way to check the original path (to and from) for your emails. There is drop down menu next to the sender address. Click on "Show Original," which will open a new window. It looks like a bunch of code (which it is, LOL), but you can suss out the to and from fields.

*

Archangel · Jan 5, 2014

Thanks for the info

I wasn't aware that GoDaddy does this now.

DNabc said:
If they don't ask you to login, and you haven't verified your email this year, then it's correct. Just make sure the website is really Godaddy.com

You only have to verify your email address once.

This just started in 2014
http://support.godaddy.com/help/article/8948/verifying-contact-information-for-icann-validation

We teach people that it isn't safe to click on email links and now they make this mandatory or the domain will be suspended?

I regged 2 last night (as mentioned earlier). They are active and in my account. I can access them. And a confirmation email never came with either, other than the standard 'Here is your order' one. GoDaddy's always been strange.

Ms Domainer said:
*

I regged one new domain last night and one today.

I did NOT receive the verification email for either one.

I'm wondering if GD decided to scrap that verification plan for now.

The one I regged last night is fully operational now.

If you have gmail, there is a way to check the original path (to and from) for your emails. There is drop down menu next to the sender address. Click on "Show Original," which will open a new window. It looks like a bunch of code (which it is, LOL), but you can suss out the to and from fields.

*

Joseph Green · Jan 5, 2014

Ms Domainer said:
I regged one new domain last night and one today.

I did NOT receive the verification email for either one.

It took about 48 hours before I received mine. However, the emails might still be in a testing phase where only a portion of Go Daddy customers receive them for the time being.

Ms Domainer said:
If you have gmail, there is a way to check the original path (to and from) for your emails. There is drop down menu next to the sender address. Click on "Show Original," which will open a new window. It looks like a bunch of code (which it is, LOL), but you can suss out the to and from fields.

Warning: The "From:" field in those headers can be set by anyone to anything they want, even [email protected]. Never trust an e-mail just because of whom it appears to be from.

cdboard · Jan 5, 2014

FWIW, I did not see the button I was supposed to click in the legitimate godaddy emails until I changed my email program to show messages in html (instead of plain text).

Joseph Green · Jan 7, 2014

I wrote this on another thread, but readers can benefit from it here too:

Joseph Green said:
I highly recommend that you enable DTVS at Go Daddy to keep your domains safe.

Go Daddy offers its customers with high-valued domain assets a service called Domain Transfer Validation Service (DTVS), which requires that Go Daddy call your phone to verify every domain transfer with you before it can complete. If a domain transfer is not vocally approved by you, the transfer will fail. They do not accept inbound calls from your phone number to verify the domain transfer, since those can be spoofed. They always call you directly to verify.

It's incredibly secure and no one can steal your domains even if they have access to your Go Daddy account and email address.

Dynadot has a couple options for additional security that I also recommend:

Dynadot Token Authentication for iPhone/Android: Requires that you generate and provide a unique code using an app on your phone each time you want to unlock any domain names in your account. The code changes every few minutes.

SMS Authentication: Sends you a text message with a random code, unique each time, to your mobile phone that is required to unlock any domain names in your account.

Other registrars have similar security measures, but these are the ones that help me sleep better at night.

domainbartender · Jan 7, 2014

Have y'all read this? Change in ICANN policies.

joshny · Jan 7, 2014

i just got this
http://postimg.org/image/4egm27ik3/
http://postimg.org/image/5nnfd9swx/

I hope this is legit??
it didn't redirect me to any fake domain, it did not ask me to log in, no OpenID mentioned anywhere
and it wasn't from [email protected]
But just in case..

P.S: Funny , HOW IT ARRIVES RIGHT WHEN THE SCAM IS GOING ON!!

ImageAuthors · Jan 8, 2014

If you're aware that these phishing scams are out there and looking for a secure way to handle things, there's a method that sounds very safe. It was posted at DomainGang. Search for "GoDaddy phishing DomainGang" and you'll find a description of what to do.

I haven't tried it, but it looks like the most robust method to deal with email verifications at GoDaddy now that ICANN has mandated these changes.

Joseph Green · Jan 9, 2014

Method referenced by ImageAuthors:

http://domaingang.com/domain-news/the-godaddy-email-confirmation-mess-do-it-in-the-domain-manager/

ImageAuthors said:
If you're aware that these phishing scams are out there and looking for a secure way to handle things, there's a method that sounds very safe. It was posted at DomainGang. Search for "GoDaddy phishing DomainGang" and you'll find a description of what to do.

lennco · Jan 10, 2014

Beware! GodaddyAdministration.com

I just got an email asking me to click this link at godaddyadministration.com and confirm my email.

ACTION REQUIRED - OpenID - Email validation

Dear Valued GoDaddy Customer,

This automated message is a reminder to help you keep the contact data associated with your domain registration up-to-date. We have the following information on record (Email), about your domain(s) name (detailed instructions here).

Email: [email protected]

(OpenID Authentication Required)

If this Change of Account is not complete within 10 days, the transaction of Change of Account will expire.

Anyone get this one yet?

I just checked the whois and the return link was just regged so BEWARE!

Domain Name : GODADDYADMINISTRATION.COM
Created On : 2014-01-05
Expiration Date : 2015-01-05
Status : ACTIVE
Registrant Name : Bartels Anke
Registrant Street1 : 19 RUE LA BLANCHE
Registrant City : puteaux
Registrant State/Province :
Registrant Postal Code : 92800
Registrant Country : FR
Admin Name : NUXIT
Admin Street1 : 400 avenue Roumanille
Admin City : Sophia Antipolis
Admin State/Province : FR
Admin Postal Code : 06903
Admin Country : FR
Admin Phone : +33.899563600
Admin Email : [email protected]
Tech Name : NUXIT
Tech Street1 : 400 avenue Roumanille
Tech City : Sophia Antipolis
Tech State/Province : FR
Tech Postal Code : 06903
Tech Country : FR
Tech Phone : +33.899563600
Tech Email : [email protected]
Billing Name : NUXIT
Billing Street1 : 400 avenue Roumanille
Billing City : Sophia Antipolis
Billing State/Province : FR
Billing Postal Code : 06903
Billing Country : FR
Billing Phone : +33.899563600
Billing Email : [email protected]
Name Server : DNS2.E-CLICKING.IN
Name Server : DNS1.E-CLICKING.IN
Registrar Name : Namebay

Registrar: NAMEBAY
Whois Server: whois.namebay.com
Creation Date: 05-JAN-2014
Updated Date: 05-JAN-2014
Expiration Date: 05-JAN-2015

Nameserver: DNS1.E-CLICKING.IN
Nameserver: DNS2.E-CLICKING.IN

evvo · Jan 10, 2014

I've received it too, this morning! It is exactly the same! the log in to confirm button, the openID thing.
I've already received the legit Godaddy "Reminder: Please verify your email address" email on the 2nd of January. It had a red banner and an verify your email address( not Log in)

nitso.com

stockify.com

zitopay.com

lextek.com

dvxt.com

browserguard.com

graphicswall.com

promobet.com

tyly.com

vati.com

GoDaddy WHOIS Verification Email - Beware of Phishing Scam

Account Closed (Disallowed)

Top Member

randypendleton.comTop Member

Top Member

Top Member

Top Member

Top Member

Top Member

Established Member

Attachments

Top Member

Top Member

randypendleton.comTop Member

Established Member

Top Member

Established Member

Your name server since 2008.Top Member

Established Member

Account Closed (Disallowed)

Established Member

Top Member

Established Member

DopeBoy.com

JMail.com

meams.com

Tanos.com

Configurator.io

Remited.com

Field.co

Fate.co

cryptohub.online

ApexGlobal.com

Similar threads

We're social

DopeBoy.com

JMail.com

meams.com

Tanos.com

Configurator.io

Remited.com

Field.co

Fate.co

cryptohub.online

ApexGlobal.com

Pinned

Appreciation

Agreement

Answers

Relevance

Reaction

Status

Feeling