Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why did secureserver.net (godaddy) access my gmail account?

One day later...gmail reports suspicious activity...really?

So...Why did secureserver.net (godaddy) access my gmail account?

http://daily.ericelias.org/why-did-secureservernet-godaddy-access-my-gma

share|improve this question
    
Hi ericelias, welcome to Information Security. Please take a moment to review the FAQ, and read How to Ask. I closed this question because it seems to apply only to your specific situation - and besides, other than some general possiblities, answers could only be speculation. –  AviD Mar 12 '12 at 11:13
    
Hey AviD - thank you for the FAQ, I will review. I could not find info on google groups, godaddy support and this was the last resort. I will consider the speculation aspect of future questions. –  ericelias Mar 13 '12 at 15:21
    
Sure. Btw, a better question would be, what should I do now and how can I protect myself from this. It seems some of the answers already relate to that point - if you edit your question accordingly, you can flag it for a moderator's attention and I will be glad to reopen it. –  AviD Mar 13 '12 at 15:29
add comment

closed as too localized by AviD Mar 12 '12 at 11:10

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers

According to my websearching, secureserver.net is a domain that's owned and operated by GoDaddy, and that GoDaddy uses to provide email services to its customers. For example, GoDaddy customers can set their SMTP server for outgoing email to smtp.secureserver.net, and use that to send outgoing email. Similarly, GoDaddy customers can read their email there (via POP or IMAP). It appears that GoDaddy also occasionally sends emails to its customers from the secureserver.net domain. GoDaddy may also use it for other purposes as well.

Did you perhaps enter your gmail account and gmail password into the secureserver.net website, or provide it to GoDaddy? Perhaps their software on that domain will check your Gmail for you if you provide it with your Gmail username and password (I am speculating now, as I am not a GoDaddy customer).

If you want to know for sure why secureserver.net accessed your Gmail account, I suggest contacting GoDaddy support.

P.S. As @tylerl suggests: change your Gmail password now.

Change your security question, too. Then, go to the Activity Monitor (click on "Details" next to the thing saying "Last account activity: X minutes ago at this IP (xx.xx.xxx.xx)") and click "Sign out all other sessions".

Also, check the list of secondary email addresses and the forwarding options for your Gmail account to make sure that your Gmail is not being forwarded somewhere (a favorite ploy of hackers, if they gain access to your Gmail account, is to set up a secondary address or forward your email to themselves, so they can regain access later using a password reset).

While you're at it, consider enabling 2-step verification); once that is activated, logging into Gmail will require both your Gmail password and access to your phone. This will help prevent cases were other try to log onto your Gmail, since they won't know the verification code that is sent to your phone.

Also, you could check the Gmail Activity Log (Activity Monitor), to see if it has any further details about what accesses have been made to your Gmail account.

share|improve this answer
    
Thank you. Yes, I already had two step verification, I only use two devices to access the account. Also, I use google apps for hosting, but the domain is hosted on godaddy. –  ericelias Mar 13 '12 at 15:19
add comment

Godaddy-hosted email (if you choose to host your email through godaddy) is hosted under the "secureserver.net" domain. In fact, the addresses you configure into your mail client are pop.secureserver.net, imap.secureserver.net, smtp.secureserver.net, etc.

If you configured your Godaddy webmail (for perhaps some other domain) to pull in mail from your Gmail account, then you will see it show up as going to secureserver.net rather than whatever domain your mail is registered under.

And if you didn't do it, someone else did. Hackers frequently go through intermediary services to mask their identity. This is as likely an answer as any.

So... change your password

share|improve this answer
add comment

secureserver.net is the name GoDaddy use as the reverse DNS for IP addresses used for dedicated/virtual server hosting. The owner of the IP address 97.74.115.169 is a GoDaddy customer. From looking at domains hosted on that address, it may be packetfusion.com.

So perhaps someone compromised their server and is using that as a proxy to access your account, or maybe someone is using whatever service it is they provide to access mail. Either way you would have to follow it up with them and not GoDaddy.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.