GoDaddy secureserver.net Relay with SPF/DMARC Pass but No DKIM - TOAD Phishing
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
Microsoft Sentinel (KQL)
