I received a delightful phishing attempt:
Please keep this email for your crypto-currency records. Someone recently used your password to try to sign into your Wallet Accoun (CASE ID:9098853964) We prevented this sign-in attempt, because this might be a criminal hacker that was trying to access your Bitcoin Account. Here are some details of the event: - Tuesday 17:45:29 AM UTC - IP Address: 107.145.285.2 (Moscow, Russia) If you did not try to access your Bitcoin wallet at that time, this was an unauthorized attempt and you should change your Wallet password immediately. Reset your password by CLICKING HERE Best Regards, BlockChain Team NOTE: If you do not want these warnings you can unsubscribe here (copyright BlockTeam 2016)
(note the extremely interesting IP address: 107.145.285.2
- I guess in Soviet Russia IP address specifies specification)
The URLs specified in the email are registered through GoDaddy (I can add the domains here if that's appropriate), so I was wondering if GoDaddy has any responsibility or cares. Can DNS providers take action if they have phishing sites hosted on domains registered through them?
Update: As I looked through the email headers I just noticed this little guy:
X-PHISHTEST: This is a phishing security test from KnowBe4 that has been authorized by the recipient organization
A quick search for KnowBe4 reveals that they're a security testing organization (or at least someone is making it look like them). So it looks like it was a phishing attempt but only by an organization that's hired to be nefarious.
107.145.285.2
is a fake IP address. – Bryan Field Sep 27 '16 at 15:21