Google Apps publishes administrator contact information

By William Entriken

4 minutes

Summary

You can look up the public contact information for any G Suite account. This includes companies that host their email with Google.

Introduction

This information is at, for example: https://www.google.com/a/arstechnica.com/DomainContact

I have looked at the Moz Top 500 list and found which websites publish their administrator information.

Here’s how to do that:

head ../domains.csv | sed -e 's/www\.//' | while read DOMAIN;
do curl "https://www.google.com/a/$DOMAIN/DomainContact" > $DOMAIN.txt
done

And here’s a quick way to filter out accounts that aren’t using G Suite and businesses that have not published information:

grep -A20 '"card' * | egrep -v '<'

Result

Here is the full text list of helpdesk employees and password reset instruction for internal employees at the top 500 websites. Surprisingly, Google does not publish its own helpdesk information for Googlers!

Conclusion

This information could be useful to social engineers. You should not publish this online in this way. Also when you train your staff, you should tell them your helpdesk contact information, rather then having them rely on third-party websites to tell them who to call.

▧

▧

Comments

Excellent info in the fight to keep customer's safe from hackers. Have you reached out to any of the above companies to share your findings and how it could negatively affect them?

Chad Elliott

Please discuss this topic anywhere and let me know any great comments or media coverage I should link here.