Why did secureserver.net (GoDaddy) access my Gmail account? [closed]

Question

Why did secureserver.net (GoDaddy) access my Gmail account?

One day later... Gmail reports suspicious activity... really?

So... Why did secureserver.net (GoDaddy) access my Gmail account?

Answer 1

Godaddy-hosted email (if you choose to host your email through godaddy) is hosted under the "secureserver.net" domain. In fact, the addresses you configure into your mail client are pop.secureserver.net, imap.secureserver.net, smtp.secureserver.net, etc.

If you configured your Godaddy webmail (for perhaps some other domain) to pull in mail from your Gmail account, then you will see it show up as going to secureserver.net rather than whatever domain your mail is registered under.

And if you didn't do it, someone else did. Hackers frequently go through intermediary services to mask their identity. This is as likely an answer as any.

So... change your password

Answer 2

secureserver.net is the name GoDaddy use as the reverse DNS for IP addresses used for dedicated/virtual server hosting. The owner of the IP address 97.74.115.169 is a GoDaddy customer. From looking at domains hosted on that address, it may be packetfusion.com.

So perhaps someone compromised their server and is using that as a proxy to access your account, or maybe someone is using whatever service it is they provide to access mail. Either way you would have to follow it up with them and not GoDaddy.

Answer 3

According to my websearching, secureserver.net is a domain that's owned and operated by GoDaddy, and that GoDaddy uses to provide email services to its customers. For example, GoDaddy customers can set their SMTP server for outgoing email to smtp.secureserver.net, and use that to send outgoing email. Similarly, GoDaddy customers can read their email there (via POP or IMAP). It appears that GoDaddy also occasionally sends emails to its customers from the secureserver.net domain. GoDaddy may also use it for other purposes as well.

Did you perhaps enter your gmail account and gmail password into the secureserver.net website, or provide it to GoDaddy? Perhaps their software on that domain will check your Gmail for you if you provide it with your Gmail username and password (I am speculating now, as I am not a GoDaddy customer).

If you want to know for sure why secureserver.net accessed your Gmail account, I suggest contacting GoDaddy support.

P.S. As @tylerl suggests: change your Gmail password now.

Change your security question, too. Then, go to the Activity Monitor (click on "Details" next to the thing saying "Last account activity: X minutes ago at this IP (xx.xx.xxx.xx)") and click "Sign out all other sessions".

Also, check the list of secondary email addresses and the forwarding options for your Gmail account to make sure that your Gmail is not being forwarded somewhere (a favorite ploy of hackers, if they gain access to your Gmail account, is to set up a secondary address or forward your email to themselves, so they can regain access later using a password reset).

While you're at it, consider enabling 2-step verification); once that is activated, logging into Gmail will require both your Gmail password and access to your phone. This will help prevent cases were other try to log onto your Gmail, since they won't know the verification code that is sent to your phone.

Also, you could check the Gmail Activity Log (Activity Monitor), to see if it has any further details about what accesses have been made to your Gmail account.