If you get an email that seems to be from GoDaddy with the subject “Complete required actions”, do not open it, and for goodness sake do not click on the links in it! Those links actually go to a malicious site at gypsymoonhookah.com/redirect.php
In other words, yes, this is a malicious email, spoofing GoDaddy. If you received it, you probably have domains registered with, or other services with, GoDaddy, and the bad guys probably got your email address from the whois entry for your domain.
That said, regardless of how you got it, do not click on it!
The Get Started button actually goes to a redirect at the malicious site at gypsymoonhookah, not to the actual GoDaddy site.
|Get notified of new Internet Patrol articles for free!
Malicious Spoofed GoDaddy Email
The Button Goes to the Malicious GypsyMoonHookah Site
If you have already clicked on the link, here’s what you need to do:
1. If you were presented with a page to log in to your GoDaddy account, and you did log in to your GoDaddy account, you need to immediately log back in to your GoDaddy acount (not through the link in the email – type godaddy.com in your browser instead), and change your password.
2. It’s possible (perhaps even likely) that a malware virus was also downloaded onto your computer, so run anti-virus software on your computer asap.
Here’s the full text of the malicious email:
Action required for your account.
We’re all about providing first-class care — it’s our top priority. Please complete required action on your account.
Activate your products today.
You have new products or services in your account waiting to be activated. Now put them to work.
*Offer good towards new product purchases only and cannot be used on product renewals. Cannot be used in conjunction with any other offer, sale, discount or promotion. Not applicable to ICANN fees, taxes, transfers, premium domains, premium templates, cloud server plans, WP Premium Support services, any marketing or design services performed by our Professional Web Services team, gift cards or Trademark Holders/Priority Pre-registration or pre-registration fees. After the initial purchase term, discounted products will renew at the then-current renewal list price. Offer may be changed without notice.
Prices are current as of 1/31/2019 and may be changed without notice.
Please do not reply to this email. Emails sent to this address will not be answered.
Copyright © 1999-2019 GoDaddy Operating Company, LLC. 14455 N. Hayden Rd, Ste. 219, Scottsdale, AZ 85260 USA. All rights reserved.
No Paywall Here!
The Internet Patrol is and always has been free. We don't hide our articles behind a paywall, or restrict the number of articles you can read in a month if you don't give us money. That said, it does cost us money to run the site, so if something you read here was helpful or useful, won't you consider donating something to help keep the Internet Patrol free? Thank you!
|Get notified of new Internet Patrol articles!