Update brand_impersonation_godaddy.yml (#3079)

markmsublime · web-flow · commit f1ee62db2c4a · 2025-08-14T10:05:50.000Z
diff --git a/detection-rules/brand_impersonation_godaddy.yml b/detection-rules/brand_impersonation_godaddy.yml
@@ -11,7 +11,7 @@ source: |
     or strings.ilike(sender.email.domain.domain, '*godaddy*')
   )
   and not (
-    sender.email.domain.root_domain == "godaddy.com"
+    sender.email.domain.root_domain in ("godaddy.com", "registry.godaddy")
     and headers.auth_summary.dmarc.pass
   )
   and not profile.by_sender().solicited

Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ source: \|`
`11`	`11`	`or strings.ilike(sender.email.domain.domain, 'godaddy')`
`12`	`12`	`)`
`13`	`13`	`and not (`
`14`		`- sender.email.domain.root_domain == "godaddy.com"`
	`14`	`+ sender.email.domain.root_domain in ("godaddy.com", "registry.godaddy")`
`15`	`15`	`and headers.auth_summary.dmarc.pass`
`16`	`16`	`)`
`17`	`17`	`and not profile.by_sender().solicited`