Why Part 1? Because I’m sure that there’s going to be more to come (although I know not what).
I own several domains, some of which I use for email. On these domains, I have a catch-all setup (email to *@<domain>.com goes to a single mailbox).
Recently I started seeing email indicating that someone was attempting to setup a Google Workspace on that domain. Here’s the email I received.
This is peculiar because I don’t use Google as the mail hosting provider. So whoever is attempting to setup this account will be unable to prove ownership of the domain as they’ll have to setup a CNAME/TXT record on the domain. The domains are not held with Google or my mail hosting provider and I don’t see any strange access on the domain hosting service account.
I tried to login to the Google Workspace console with the username and since I didn’t have the password, Google’s Account Recovery kicked in. It asked me to either
- Get a verification code at kd******@gmail.com
- Enter the First and Last name on the Google account
- When is the last time you remember signing in to this Google Account?
- Enter the organization name for this account. It should match the name set in your Admin console.
- Enter the number of users of your Google Workspace account
All of which I obviously don’t have. So I went into the “contact support” account recovery process …
But this whole thing is peculiar.
- Who would setup a workspace account with a username of 8459227276@<domain.com>? The number appears like a telephone number (in NY?)
- Who would try to setup a workspace account in a domain they don’t own?
Let’s see what Google support can do for me …
Hype Cycles 