Weird IP address appeared on my godaddy account

Question

I recently checked the dns table in my go-daddy account and found the IP address 68.178.232.99 under the A table next to the @ (naked domain).

Whenever I tried to connect to the naked domain, it sent me to Google servers as it should (i'm working with Google apps). However, anyone who wasn't me (i.e. connected from a different IP address I guess), arrived at a page full of commercial links and the writing "This page is parked free, courtesy of Google Apps" (clearly not a Google page).

Opening the address in the browser returned a blank page (or so it seemed?). A Google search on the IP address showed inconclusive evidence and mentions related to abuse.

Of course I deleted it and replaced it with Google's IP.

Was wondering - does this mean someone hacked into my go-daddy account?

maybe SOPA was there. who knows... – pdu Jan 27 '12 at 13:11 — pdu, Jan 27 '12 at 13:11

Dave M · Answer 1 · 2012-01-27T14:19:42.977

2

The IP 68.178.232.99 is registered to Go-Daddy so it would seem to be legitimate. Perhaps a call to Go Daddy support would clear this up quickly

edited Jan 27 '12 at 14:19

answered Jan 27 '12 at 13:53

Dave M

4,494
21
30
30

Yeah I sent them an email. Will update as soon as I find something new. – Uri Jan 28 '12 at 14:34

score 1 · Answer 2 · answered Jan 27 '12 at 14:52

Right, so, a whois on that IP returns all GoDaddy related information. Sounds more like something was going wonky with how you set up Google Apps, not necessarily that you were hacked.

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=68.178.232.99?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       68.178.128.0 - 68.178.255.255
CIDR:           68.178.128.0/17
OriginAS:       
NetName:        GO-DADDY-SOFTWARE-INC
NetHandle:      NET-68-178-128-0-1
Parent:         NET-68-0-0-0-0
NetType:        Direct Allocation
RegDate:        2005-04-12
Updated:        2007-06-14
Ref:            http://whois.arin.net/rest/net/NET-68-178-128-0-1

OrgName:        GoDaddy.com, Inc.
OrgId:          GODAD
Address:        14455 N Hayden Road
Address:        Suite 226
City:           Scottsdale
StateProv:      AZ
PostalCode:     85260
Country:        US
RegDate:        2007-06-01
Updated:        2009-09-16
Comment:        Please send abuse complaints to abuse@godaddy.com
Ref:            http://whois.arin.net/rest/org/GODAD

OrgTechHandle: NOC124-ARIN
OrgTechName:   Network Operations Center
OrgTechPhone:  +1-480-505-8809 
OrgTechEmail:  noc@godaddy.com
OrgTechRef:    http://whois.arin.net/rest/poc/NOC124-ARIN

OrgNOCHandle: NOC124-ARIN
OrgNOCName:   Network Operations Center
OrgNOCPhone:  +1-480-505-8809 
OrgNOCEmail:  noc@godaddy.com
OrgNOCRef:    http://whois.arin.net/rest/poc/NOC124-ARIN

OrgAbuseHandle: ABUSE51-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-480-624-2505 
OrgAbuseEmail:  abuse@godaddy.com
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE51-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

It sounds logical, but then why would GoDaddy have this commercial links page maintained, and why was I the only one not arriving at this page? — Uri, Jan 28 '12 at 14:37

Weird IP address appeared on my godaddy account

2 Answers2