NameSilo

GoDaddy Phishing email

Spaceship Spaceship
Watch

amr_100

Established Member
Impact
14
Below are the raw message contents:

X-Eon-Dm: dm42
Return-Path: <[email protected]>
Received: from server.vipreseller5.net (70.86.255.130 [70.86.255.130])
by dm42.mta.everyone.net (EON-INBOUND) with ESMTP id dm42.4981cd42.55ccbf
for <[email protected]>; Sat, 31 Jan 2009 14:21:29 -0800
Received: from nobody by server.vipreseller5.net with local (Exim 4.69)
(envelope-from <[email protected]>)
id 1LTOBo-0007K5-W3
for [email protected]; Sat, 31 Jan 2009 20:19:48 -0200
Date: Sat, 31 Jan 2009 20:19:48 -0200
To: [email protected]
From: [email protected]
Reply-To:
Subject: Go Daddy - Domain Security Update
Message-ID: <[email protected]>
X-Priority: 1
X-Mailer: PHPMailer (phpmailer.sourceforge.net) [version ]
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/html; charset="iso-8859-1"
Sender: Nobody <[email protected]>
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - server.vipreseller5.net
X-AntiAbuse: Original Domain - XXXX.com
X-AntiAbuse: Originator/Caller UID/GID - [99 500] / [47 12]
X-AntiAbuse: Sender Address Domain - server.vipreseller5.net
X-Source:
X-Source-Args: /usr/local/apache/bin/httpd -DSSL
X-Source-Dir: maepobre.org.br:/public_html/fotos/albums/userpics

<head>
<style type="text/css">
.style1 {
text-decoration: underline;
}
</style>
</head>

<p>
<img alt="" src="http://imagesak.godaddy.com/fos/log/1/log_hdr_gd.png" width="124" height="71"></p>
<p>�</p>
<p><span class="style1">Dear : Go Daddy Customer</span><br>
<br>
We recently have determined that different computers have logged into your<br>
Go Daddy account, and multiple password failures were present before the logons.<br>
We now need you to log into your account and verify your account activity.<br>
count we have issued this warning message.<br>
<br>
It has come to our attention that your Go Daddy account information needs to be
<br>
reactivated as part of our continuing commitment to protect your account and to
<br>
reduce the instance of fraud on our website in this new Season.<br>
Once you have reactivated your account records your Go Daddy account<br>
service will not be interrupted and will continue as normal. <br>
<br>
To reactivate your Go Daddy Account click on the following link: <br>
<a href="http://dcc.godaddy.com.60206050406050402010602004060504060406546465465465465749879465.rsbinvestments.net/login.idp.godaddy.com/login.idp.godaddy.com/login.aspxSPKey=/login.aspxSPKey=GDDCCEB05&myaUrl=fdefault.aspxci=8987/login.aspxSPKey=update/goddady-update/index.php">
reactivate your Go Daddy Account</a><br>
<br>
Thank You</p>
 
0
•••
The views expressed on this page by users and staff are their own, not those of NamePros.
AfternicAfternic
I got a similar one.
 
0
•••
I was duped by it.
First time ever.
saw rbsinvestments.net in url just in time.
 
0
•••
The ironic thing is I never even look at my GD emails. Too many of em - I ususally check the domains daily anyhow.
 
0
•••
WoW... I changed my password - but asked Samit if what I did was right or not... :lol:.... was lucky and reset it.
 
0
•••
http://whois.domaintools.com/rsbinvestments.net

Front Page Information
Website Title: RSB Investments Real Estate Appraisal
Title Relevancy 100%
AboutUs: Wiki article on Rsbinvestments.net
SEO Score: 79%
Terms: 140 (Unique: 98, Linked: 11)
Images: 7 (Alt tags missing: 7)
Links: 3 (Internal: 2, Outbound: 0)
Indexed Data
Registry Data
ICANN Registrar: MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE
Created: 2008-06-24
Expires: 2010-06-24
Updated: 2008-07-10
Registrar Status: ok
Name Server: NS309.WEBSITEWELCOME.COM (has 436,868 domains)
Name Server: NS310.WEBSITEWELCOME.COM
Whois Server: whois.melbourneit.com
Server Data
Server Type: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
IP Address: 74.52.238.226 Whois | Reverse-IP | Ping | DNS Lookup | Traceroute
IP Location United States - Texas - Dallas - Theplanet.com Internet Services Inc
Response Code: 200
SSL Cert: *.websitewelcome.com expires in 534 days.
Domain Status: Registered And Active Website
DomainTools Exclusive
Registrant Search: "Raymond Baquedano" owns about 1 other domains
Email Search: is associated with about 713,737 domains
NS History: 2 changes on 3 unique name servers over 1 year.
IP History: 4 changes on 4 unique name servers over 1 years.
Whois History: 4 records have been archived since 2008-06-26.
Reverse IP: 1,765 other sites hosted on this server.
Monitor Domain: [Monitor this domain] Set Free Alerts on rsbinvestments.net
Free Tool: Download DomainTools
Whois Record

Domain Name.......... rsbinvestments.net
Creation Date........ 2008-06-25
Registration Date.... 2008-06-25
Expiry Date.......... 2010-06-25
Organisation Name.... Raymond Baquedano
Organisation Address. P O Box 99800
Organisation Address.
Organisation Address. EmeryVille
Organisation Address. 94662
Organisation Address. CA
Organisation Address. US

Admin Name........... PrivateRegContact Admin
Admin Address........ P O Box 99800
Admin Address........
Admin Address........ EmeryVille
Admin Address........ 94662
Admin Address........ CA
Admin Address........ US
Admin Email..........
Admin Phone.......... +1.5105952002
Admin Fax............

Tech Name............ PrivateRegContact TECH
Tech Address......... P O Box 99800
Tech Address.........
Tech Address......... EmeryVille
Tech Address......... 94662
Tech Address......... CA
Tech Address......... US
Tech Email...........
Tech Phone........... +1.5105952002
Tech Fax.............
Name Server.......... ns309.websitewelcome.com
Name Server.......... ns310.websitewelcome.com

RSB Investments
Real Estate Appraisal Services

16010 Jalon Road
La Mirada, CA 90638

Direct: (714) 521-8676
Fax: (714) 736-5125
Cell: (562) 715-1713

Email: [email protected]
 
0
•••
0
•••
Thats a subdomain, not a subdirectory.

Tough to miss that in your site.

Though it might be...
 
0
•••
Once again, never click a link in an email !!!!

Go directly to the site via address bar or google it...

Or if says it is important, call them, do not use links in email ....

Safety first , scammers can go to hell
 
0
•••
Dynadot — .com Registration $8.99Dynadot — .com Registration $8.99
Appraise.net

We're social

Unstoppable Domains
Domain Recover
DomainEasy — Live Options
  • The sidebar remains visible by scrolling at a speed relative to the page’s height.
Back