Phishing scams aren’t going away anytime soon. In fact, they continue to be one of the biggest threats consumers face. Scammers are continually improving their craft to make even the savviest consumer fall prey to their campaigns. This time, GoDaddy customers appear to be the targeted victims. In this scam, a GoDaddy user receives an email from what appears to be [email protected]. The normal email headers all seem to point to a legitimate email. The “from” address is [email protected] and the name of the sender is also GoDaddy. Seems legit so far. Within the body of the phishing email, the user is notified that their email account storage has been maxed out and that incoming emails are being rejected. This is a message no one wants to receive, as you won’t know what juicy or important emails you may be missing. Increasing the urgency, the email states that you must upgrade within 24hrs or your account will be suspended – yikes – BUT, there’s a solution, all you have to do is upgrade to a 2GB account – it’s free to do so – you just need to click on the link.
Now this is where they may lose the savvy consumer. Here’s why: the link within the email goes to http://mtparent.com/themes/www.html. Hmm, not exactly what one would expect from an official GoDaddy site. First off, it’s an http page, not https meaning that the connection is not secure. From this screenshot you can see that Chrome is displaying that this connection is not secure. That’s a big red flag that every consumer should know. NEVER give a non-https website any kind of sensitive information…EVER.
Still, the reason these scams work is that most of us aren’t paying close enough attention to these warning flags, things like the absence of proper certificates, or odd domain names in addresses, or “http” in a URL vs. “https.”
In this case, if you were to enter your username and password information and click “Log In,” it actually takes you to an official https GoDaddy page with a “Let’s Talk” dialog box and with an official GoDaddy issued certificate. And at this point you’re at the official GoDaddy site.
Now, if you are observant, you might notice that you’re still not logged in and that your account, in fact, hasn’t been upgraded.
To most this would be annoying that you have to login again, but in reality the scam has already been completed and probably 97% of your fellow victims are none the wiser. Once you clicked on the “Log In” button, anything in the username and password boxes was transmitted to the scammer.
The lesson from this particular scam is to be vigilant, especially when a link or logins or passwords are involved. Continually look for the clues that scammers leave behind. Website traits such as https, and valid digital certificates issued by reputable Certificate Authorities should be the first thing you look for, anytime a website asks you for any information. If those things aren’t present, we can almost guarantee you that there’s a problem. In general, if something seems off, it probably is. Best then to contact the company via established channels that you’ve successfully used before.
Phishing works because we, the working population, are too busy, and trusting of the information we receive. We need educate ourselves to be far more vigilant and know these warning signs, phishing scams like this aren’t going anywhere, anytime soon.
Comodo Threat Research Labs (CTRL) is made up of more than 140 IT security professionals, computer scientists and engineers, all full-time Comodo employees, analyzing and filtering spam, phishing and malware from across the globe. With R&D centers in the U.S., Turkey, Ukraine, the Philippines and India, the CTRL team analyzes more than 10 million potential pieces of malware, phishing, spam or other malicious/unwanted files per day, using their insights and findings to help protect and secure Comodo’s entire Internet community.
Comodo has shared information with GoDaddy on this scam prior to publishing this article.
