Today I get an email that looks like it came from GoDaddy except for a few things that don’t look right…
Email Headers are not correct, this was obviously a shitty job as the malicious user tried to make the email look like it was coming from godaddy but was actually coming from a compromised wordpress install on Hostgator.
From: Godaddy <donotreply@m.godaddy.com> Message-Id: <E1YXF6r-0008QX-BX@gator4163.hostgator.com>
The Email:
Dear Customer MIGUEL VALLEJO. Confirm Your Identify.
An unknown user was trying to login your GoDaddy account with an incorrect password on Sunday 15 March , 2015 1:05 GMT, and with an unknown DNS IP Location:
(China) ip=36.250.74.87, as a result of that we partially blocked your GoDaddy accounts due to major security protocols.Kindly visit our GoDaddy account Re-Activation Center Click here :
https://accounts.godaddy.com/do.php?check= e3251075554389fe91d17a794861d4 7be3251075554389fe91d17a794861 d47b We are sincerely sorry for any inconvenience.
GoDaddy Customer Support.
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Copyright (c) 1999-2015 GoDaddy.com, LLC. All rights reserved.
Except for the fact that there is no administrative contact info, phone, business address in the signature it looks somewhat legit. Now Lets look at body of the email specifically at the url and where the link points to…
http://someweirddomain.com/wp-includes/css/nvldigkoua.htm?nvldigkoua=e3251075554389fe91d17a794861d47b
So this is obviously a malicious email, a targeted one because the user had to go through some effort to put this type of attack together. Sadly this is someone trying to dupe you into coughing up your password or in my case a sad attempt at doing so.
It’s a good idea to go over some security logs after events like this as it could be a sign of someone already in your network and trying to escalate their access.
In my case it was just some noob who though he was dealing with a end user, my response… <^>-_-.
