This bug seems glaringly obvious. Any page which has the user login and password credentials for Enom Domain Manager page would initially have someone like me who is more security conscious looking at things like the URL and also noticing this type of bug.

Then again, you'd need to buy your domain through Google Apps to notice this. Maybe not many people buy their domain through Google Apps?

I'm interested to know how long this bug was out in the wild before it was found. Months? Days?

Good find Saket and great story.