HostPapa abuse treasure trove discovered in GoDaddy email threat hunt · Blog · Sublime Security

This Attack Spotlight analyzes a set of phishing campaigns observed abusing hosting providers (HostPapa, GoDaddy) and cloud services to deliver credential-phishing (including AITM), callback scams, financial/social-engineering fraud, and malicious SVG attachments with obfuscated JavaScript; it highlights specific TTPs (copy/paste URL obfuscation, double extensions, DNA-sequence JS encoding), detection signals (SPF/DMARC failures, self-sender patterns), and example IOCs used to demonstrate detection and prevention.