If you get an email that seems to be from GoDaddy with the subject “Complete required actions”, do not open it, and for goodness sake do not click on the links in it! Those links actually go to a malicious site at gypsymoonhookah.com/redirect.php
In other words, yes, this is a malicious email, spoofing GoDaddy. If you received it, you probably have domains registered with, or other services with, GoDaddy, and the bad guys probably got your email address from the whois entry for your domain.
That said, regardless of how you got it, do not click on it!
The Get Started button actually goes to a redirect at the malicious site at gypsymoonhookah, not to the actual GoDaddy site.
Malicious Spoofed GoDaddy Email
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
The Button Goes to the Malicious GypsyMoonHookah Site
If you have already clicked on the link, here’s what you need to do:
1. If you were presented with a page to log in to your GoDaddy account, and you did log in to your GoDaddy account, you need to immediately log back in to your GoDaddy acount (not through the link in the email – type godaddy.com in your browser instead), and change your password.
2. It’s possible (perhaps even likely) that a malware virus was also downloaded onto your computer, so run anti-virus software on your computer asap.
Here’s the full text of the malicious email:
Action required for your account.
We’re all about providing first-class care — it’s our top priority. Please complete required action on your account.
Get Started
Activate your products today.
You have new products or services in your account waiting to be activated. Now put them to work.
Get Started
*Offer good towards new product purchases only and cannot be used on product renewals. Cannot be used in conjunction with any other offer, sale, discount or promotion. Not applicable to ICANN fees, taxes, transfers, premium domains, premium templates, cloud server plans, WP Premium Support services, any marketing or design services performed by our Professional Web Services team, gift cards or Trademark Holders/Priority Pre-registration or pre-registration fees. After the initial purchase term, discounted products will renew at the then-current renewal list price. Offer may be changed without notice.
Prices are current as of 1/31/2019 and may be changed without notice.
By using these products, you agree that you are bound by the Universal Terms of Service and Privacy Policy. Learn more about our Refund Policy.
Please do not reply to this email. Emails sent to this address will not be answered.
Copyright © 1999-2019 GoDaddy Operating Company, LLC. 14455 N. Hayden Rd, Ste. 219, Scottsdale, AZ 85260 USA. All rights reserved.
2215617298
The Internet Patrol is completely free, and reader-supported. Your tips via CashApp, Venmo, or Paypal are appreciated! Receipts will come from ISIPP.
CashApp us
Venmo us
Paypal us
