I received an email today with a subject of “GoDaddy Domain Account Upgrade Confirmation“, see the captured email looks like. I am not aware of GoDaddy’s upgrade confirmation so I checked the link provided to the email. The link behind “Click here Upgrade account” and call to action image “Go to My Account” are linked to an IP Address 115.47.19.5:3389. I checked the IP Address owner, it is assigned in China. I don’t know about you, but GoDaddy is based in USA. The 3389 after the colon, is a port number use for remote access. Actually, this is the default port number for most Windows Remote Server or Terminal Server.
Here’s the IP Address (115.47.19.5) Owner information:
inetnum: 115.47.0.0 – 115.47.255.255
netname: XRNET
descr: Beijing XiRang Media Cultural Co., Ltd.
descr: Build A6-1702,Fenghuahaojing,No.6 Guanganmennei Road
descr: Xuanwu, Beijing, China, 100053
country: CN
admin-c: DL762-AP
tech-c: DL762-AP
mnt-by: MAINT-CNNIC-AP
mnt-lower: MAINT-CNNIC-AP
mnt-routes: MAINT-CNNIC-AP
changed: [email protected] 20080711
status: ALLOCATED PORTABLE
source: APNIC
netname: XRNET
descr: Beijing XiRang Media Cultural Co., Ltd.
descr: Build A6-1702,Fenghuahaojing,No.6 Guanganmennei Road
descr: Xuanwu, Beijing, China, 100053
country: CN
admin-c: DL762-AP
tech-c: DL762-AP
mnt-by: MAINT-CNNIC-AP
mnt-lower: MAINT-CNNIC-AP
mnt-routes: MAINT-CNNIC-AP
changed: [email protected] 20080711
status: ALLOCATED PORTABLE
source: APNIC
person: Dong Lin
nic-hdl: DL762-AP
e-mail: [email protected]
address: Build A6-1702,Fenghuahaojing,No.6 Guanganmennei Road, Xuanwu
address: Beijing, China, 100053
phone: +86-010-83554017
fax-no: +86-010-83514169
country: CN
changed: [email protected] 20060406
mnt-by: MAINT-CNNIC-AP
source: APNIC
nic-hdl: DL762-AP
e-mail: [email protected]
address: Build A6-1702,Fenghuahaojing,No.6 Guanganmennei Road, Xuanwu
address: Beijing, China, 100053
phone: +86-010-83554017
fax-no: +86-010-83514169
country: CN
changed: [email protected] 20060406
mnt-by: MAINT-CNNIC-AP
source: APNIC
If you received a similar email, simply delete it.
Thank you,
Support, KING.NET
If this helped you, please take the time to share this post by sharing using Google+, Facebook, or Twitter.
0 Comments