Detection rules › Sublime MQL
Brand impersonation: GoDaddy
Detects messages where the sender is impersonating GoDaddy through display name manipulation or lookalike domains, while not being legitimately authenticated from GoDaddy's infrastructure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
regex.icontains(sender.display_name, 'godaddy')
or strings.ilike(sender.display_name, "*godaddy*")
or strings.ilevenshtein(sender.display_name, 'godaddy') <= 1
or strings.ilike(sender.email.domain.domain, '*godaddy*')
)
and not (
sender.email.domain.root_domain in (
"godaddy.com",
"registry.godaddy",
"sucuri.net"
)
and headers.auth_summary.dmarc.pass
)
and not profile.by_sender().solicited
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects messages where the sender is impersonating GoDaddy through display name manipulation or lookalike domains, while not being legitimately authenticated from GoDaddy's infrastructure.
- inbound message
any of:
- sender.display_name matches 'godaddy'
- sender.display_name matches '*godaddy*'
- sender.display_name is similar to 'godaddy'
- sender.email.domain.domain matches '*godaddy*'
not:
all of:
- sender.email.domain.root_domain in ('godaddy.com', 'registry.godaddy', 'sucuri.net')
- headers.auth_summary.dmarc.pass
not:
- profile.by_sender().solicited
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.ilevenshtein, strings.ilike. Reference lists: $high_trust_sender_root_domains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | godaddy |
strings.ilike | substring | *godaddy* |
strings.ilevenshtein | fuzzy | godaddy |
sender.email.domain.root_domain | member | godaddy.com |
sender.email.domain.root_domain | member | registry.godaddy |
sender.email.domain.root_domain | member | sucuri.net |