Posted in ISC on June 21st, 2010 by ISC Handler
A number of readers (and myself included) have received an email claiming to be from GoDaddy. The email is grammatically correct, and appears quite genuine. The subject is GoDaddy.com Order Confirmation and interestingly the images within the HTML are pulled from imagesak.godaddy.com, excepting one which came from hxxp://img.securepaynet.net/bbimage.aspx?pl=somecodeandmyemailaddress. The links in the emails I have seen point to hxxp://dextersss-com-ua.1gb.ua/zzx.htm among others. The phishing site and IP address and domain registration are in the Ukraine.
Thanks to Christopher and Dwight!
Cheers,
Adrien de Beaupr
EWA-Canada.com (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
Thanks to Christopher and Dwight!
Cheers,
Adrien de Beaupr
EWA-Canada.com (c) SANS Internet Storm Center. http://isc.sans.org Creative Commons Attribution-Noncommercial 3.0 United States License.
Tags: News
