In the middle of the Advent season, the web host GoDaddy from Arizona, USA, sent its employees an email with the subject “GoDaddy Holiday Party”. It turned out to be a nasty prank, however.

According to a report by the local regional newspaper The Copper Courier, this email promised a holiday bonus of 650 US dollars and included two links encouraging employees to submit their contact details in order to receive the bonus.

Training instead of bonus Two days later, the 500 Affected employees received a message from the company’s Chief Security Officer that there would be no bonus and that they had not passed the company’s internal phishing test. For this reason, you would have to go through the “Security Awareness Social Engineering training” again.

Apparently, this type of test is not an isolated case in US companies. Specialized service providers also offer such phishing tests in German-speaking countries. One of the main criteria for a phishing email is a suspicious sender address that does not match the content. The phishing email from GoDaddy had the sender address happyholiday@godaddy.com, which many employees may have interpreted as an indication of its authenticity.

GoDaddy’s need for security The web host has a declared interest in protecting itself against phishing, among other things, because at the end of 2019 the company was the victim of an attack , from which an “unauthorized individual” tapped customer data. GoDaddy has around 19 million users.

Given the company’s record earnings and the tense situation caused by the pandemic, the shape of the test works but unnecessarily insensitive. According to a report by the news portal Gizmodo, none of those affected received a bonus. Keeping this promise would at least not have diminished the effect of the test in retrospect. (akr)