The GoDaddy Renewal Phish That Never Touched GoDaddy

A staff member at a small food-service business opened a message that looked like bad news from their domain registrar. The GoDaddy logo sat at the top. The footer matched. The subject warned that an account was about to be suspended, and the body gave a flat 24 hours to update payment before the domain went dark. One button, Update Payment, promised to fix it.

Not one byte of that message authenticated it to GoDaddy.

The email carried no DKIM signature and no DMARC record evaluation at all. The single authentication pass in the headers validated the machine that sent it, a DreamHost virtual private server, and nothing more. And the button did not lead to GoDaddy. It led to a credential form that an attacker had quietly bolted onto the hacked website of a real water utility company halfway around the world.

The Notice That GoDaddy Never Signed

Brand impersonation usually forces a choice between two tradecraft styles. Some attackers register a convincing lookalike domain and configure it properly so their mail passes authentication. Others skip all of that and simply paint the brand on top of whatever infrastructure they already control. This campaign took the second, lazier road, and it still landed in the inbox.

The From address was Godaddy@vps67673.dreamhostps[.]com. The display name said Godaddy. The envelope said DreamHost. Those two things have no relationship, and the header stack made no attempt to hide it. There was no DKIM header to inspect and no DMARC policy in play. The lone SPF pass covered vps67673.dreamhostps[.]com, the sending host itself, because that server is legitimately allowed to send for its own DreamHost domain. That pass tells you the mail really came from that box. It tells you nothing about GoDaddy, and it certainly does not mean GoDaddy authorized anything.

The sending server was not a mail platform in any normal sense. An X-PHP-Originating-Script header exposed the culprit: a PHP script named acc.php was generating and blasting the messages directly from the VPS. That is the signature of a compromised or attacker-rented server running a homemade bulk mailer, not a marketing platform or a real registrar's notification system. GoDaddy sends its renewal reminders from authenticated, DKIM-signed infrastructure. A PHP file on a random DreamHost box does not.

A Phishing Form on Someone Else's Server

The interesting move was where the Update Payment button pointed. It did not resolve to a freshly registered typosquat, which is what reputation filters are tuned to catch. It resolved to a script planted on the website of a legitimate water utility company, a real business whose site had been compromised and turned into a host for the attacker's landing page. Our platform's URL scanner and screenshot capture confirmed the page was live and serving a malicious credential-harvesting form, and scored the destination as malicious.

Hosting the phishing page on a hijacked but legitimate site is the whole trick. The domain is aged, it has real traffic history, and it carries none of the freshly-minted red flags that a brand-new attacker domain does. A reputation-only URL check sees an established site and waves it through. The utility's owners are victims here too. Their web server was co-opted to launder a credential-theft page under their good name, most likely through an unpatched CMS or a stolen hosting credential, and the phishing form drops any typed password straight into the attacker's hands.

Put the two halves together and the campaign is almost entirely built from other people's resources. The sending muscle is a rented or hacked VPS. The landing infrastructure is a stranger's compromised website. The only original asset the attacker supplied was the copied GoDaddy branding and the deadline.

See Your Risk: Calculate how many threats your SEG is missing

Mapping to MITRE ATT&CK

The tradecraft lines up cleanly with the MITRE ATT&CK framework:

• T1566 Phishing and T1566.002 Spearphishing Link cover the core delivery: a brand-spoofed message whose payload is a single link to a hosted form.
• T1204.001 User Execution: Malicious Link covers the action the whole email was engineered to produce, one click on Update Payment.
• T1584.004 Compromise Infrastructure: Server covers the hijacked water-utility web server pressed into service as the credential harvesting host.

Indicators of Compromise

Where Static Checks Break Down

Authentication and reputation both had a plausible reason to pass this message. SPF was satisfied because the DreamHost host is authorized to send for itself. The landing URL sat on an established domain with real history. A gateway that scores mail on those two axes alone has no clean reason to block. The deception lives in the relationship between what the reader sees, GoDaddy, and what the machine can prove, a PHP script on an unrelated server pointing at someone else's hacked site.

That gap is where our Adaptive AI earns its keep. Themis, the analyst on the IRONSCALES platform, reads the whole picture the way a trained human would: the impersonated brand, the mismatched sending domain, the absence of any DKIM or DMARC tie to GoDaddy, and a link that resolves to infrastructure with no connection to the brand it claims. The 2024 Verizon Data Breach Investigations Report found phishing present in 15 percent of breaches and stolen credentials involved in 38 percent, the single most common initial action, which is precisely the outcome a page like this is built to feed. The Microsoft Digital Defense Report 2024 documents the same drift toward abusing legitimate, trusted infrastructure rather than breaking it, and the FBI's 2023 Internet Crime Report ranks business and brand impersonation among the costliest fraud categories year after year. Across the 35,000+ security professionals and 17,000+ organizations on our platform, the pattern repeats: the messages that reach inboxes are the ones that look procedurally clean.

The Takeaway

A copied logo and a countdown clock are cheap. Authentication and provenance are not. When a renewal notice arrives with a deadline, the safe move is to ignore the button entirely, open a fresh tab, type the provider's real address by hand, and check the account there. A genuine registrar does not send its billing alerts from a PHP script on a random VPS, and it does not park its payment portal on a water utility's website. Pairing that reflex with behavioral detection is what closes the gap this campaign leaned on. See where brand impersonation and credential harvesting risk hides in your own mail flow, because the next fake renewal notice is already being blasted from someone else's server.

CISA's guidance on recognizing and stopping phishing early is a solid reference for building that habit across a team: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one