advice How Two Factor Auth totally saved my A**!

[frostify]

I'm hoping that this post serves to vouch for how two factor authentication on your domain accounts can protect your account and keep your investments secure.
-
The true story:

The night before I got a strange email from a Chinese company asking if I would permit a company in China to operate under the company name "Frostify" which as you may recognize is and has been my username on NamePros (as well as Flippa, Pheenix, and other domaining related sites). As I am the owner of Frostify.com (which is available to anyone on BB had this company wanted to rightfully buy it) and have used it as my username/"brand" for about 5 years, I told them they cannot have it unless they were willing to buy the rights along with the .COM on BB.

Now keep in mind this email (which I read from my @yahoo.com account on Yahoo.com itself through the web browser on chrome with a Mac Mini that I keep up to date and basically malware/virus free) had no file attachments or downloads or anything like that.

No response from Chinese company, I go to sleep.

So I was awaken at 8AM before my commute to work when my phone went off with a text message. I thought maybe it was a friend or family wanting to chat but this message came from GoDaddy and said "Your 2-Step Verification Code is: 123456" (obviously not the actual code). The only time I receive this message is after a successful username/password attempt on my GoDaddy account and then the final step would be to enter this code. LUCKILY the two factor auth is the ONLY thing that stopped a potential hacker from getting into the account (which has Frostify.com assigned to it as well as many other investment domains and even personal names such as *firstname*.xyz and *firstlastname*.com and domains of website projects I have.) I would honestly say it would be much worse for me financially to have my GoDaddy account hacked then it would be to have my bank acc hacked. (it's harder to recover from a domain hack, I also have more in "savings" with domains than I do in USD).

I have no proof that it was the company from the email the night before that had attempted to hack my account but it is possible. I don't mean to wrongfully accuse them as I have no proof. This is speculation on my part.

I immediately contacted GoDaddy and they were able to confirm that 2 factor stopped them and then urged me to change my pass which I immediately did.

I still have no clue as to how they got my password as it was a password I only used on GoDaddy and it was very secure with symbols, upper case, lower case, and numbers. That part still concerns me.

Now I'm not going to lie, two factor auth is very annoying at times, especially when you just need to make a quick change or check on something you need to wait for them to text you a pin and enter it and all that but it's worth it!

Moral of the story, please enable 2 factor auth on your domain accounts to keep it secure, by having it I totally avoided a nightmare situation where I would have stood to loose my NP username .COM, my personal name .COM, multiple LLLL.com's, One Word Dictionary .com's, and more.

TL;DR: A company *may have* tried to hack into my GoDaddy account, 2 factor auth saved me, everything was fine all due to 2 factor, go now and enable 2 factor.

Edits: disclaimers regarding potential source of the attack.

 

[Nitindomains]

This problem was long resolved but good advice.
Also, always enable 2FA

Were you using a Yahoo account to handle emails?
Did you reply back to the Chinese company using your Yahoo account?
If yes, then the problem is Yahoo. They must have sniffed the IP and could have installed a stealth malware/program/keylogger to do the needful.

Must only use Gmail for IP masking.

 

[DN_Hunter]

I think there's another possible explanation.

A potential hacker might have called GoDaddy support looking for help to retrieve their account. They can't remember their email used or the username. So the GD Support person will ask fro a Domain Name that is in the account. When the GD Support person tries to access the account associated with the domain name provided by the "hacker", the 2FA will trigger a text with the code. NOTE: it might not be a "hacker" -- it could be a person who actually needs help retrieving their account, but they lost a domain name in GD Expired Auctions but they still think they own it.

Regards,
DN

 

[Ted.T]

Since I enabled 2FA I contacted support several times through chat. I wouldn't believe that a potential hacker contacted support and the sms was the last barrier between him and the desired account. First, when you contact support, you need to add your customer number. Second, every support member asks for your 4 Digit code, and only then the sms is sent.

As I see, potential hacker needs a lot of account info to contact the support, so I don't think it's the situation.
It looks like a coordinated attack, and as others said, a potential malware installed. I'm sure that the lists of compromised yahoo accounts are being sold on the black-market, and for chinese companies it's very easy to buy and use them. So, a compromised email could be the first step in this attack.

 

[frostify]

I believe social engineering is how they hacked my account.
I did not use yahoo, I used a self hosted [email protected] email that was hosted with GoDaddy.

Again, nothing was lost, all is secured now, but be cautious.

 

[dommmain]

It's strange that there are still registrars these days that do not offer their customers 2 factor auth.