[superseeplus]

Are there any indications that the email is even a phishing email? The email is from an internal address. Do they mean to say that their internal email system can’t detect fake emails purporting to be from an internal address? This is cruel in multiple ways. Promising a non existent bonus and then blaming employees for failing a phishing test (which is not even a real phishing email or exposes deep seated IT inadequacies). Presumably this goes on their performance report too.

[agotterer]

I was thinking the same thing. You shouldn’t fail by clicking a link sent by an internal email address. If the link took you to an external site and you entered your GoDaddy credentials or provided personal information, that might be a different story.

[vitus]

> You shouldn’t fail by clicking a link sent by an internal email address.

I disagree in making this broad of a claim -- insider threats are certainly an issue. And as a sibling commenter points out, email headers are easily spoofed.

I'm not condoning GoDaddy's pentest (agreed with everyone else who sees this as a cruel prank), but also, um, why would you click a link if your company is telling you they're going to pay you a bonus? Wouldn't that just go through payroll as with everything else?

edit: it looks like the phishing email provided the bonus as an opt-in? yeah, that ought to raise red flags that it's not just being applied across the board, but still, it's been a tough year, so people might not think as hard about it.

[michaelt]

> email headers are easily spoofed.

Not if they've properly deployed DKIM and SPF - which, if they have a phishing problem, should have been among their top priorities.

[vitus]

should have been != was

I don't know what the security situation is like at Godaddy, but I'm sure there's some amount of investment needed to roll that out broadly without accidentally breaking existing employee workflows.

And my point still stands re: insider attack. At least at Google, anyone could ostensibly register [e-mail] (or some variation if it's already taken) as an alias or a mailing list, which removes the need for spoofing.

[chris11]

Entering personal info might also be understandable. My employer gives a Christmas gift. This year they asked us to update a form with our temporary address if we were in a different location.

[vitus]

Absolutely, in the context of a physical item being shipped to you (especially if they can't just distribute it at the office), if it's not through payroll. (e.g. we had site-specific fun events in lieu of the annual holiday party)

But a cash bonus? That's the epitome of something that 1) should go through payroll and 2) should just get direct-deposited into your bank account as is the case with your regular paycheck. There's no reason why you'd need to provide any additional info.

[xref]

It was sent from “@gocladdy.com” and tried to trick users with the kerning between “d” and “cl”, where are you seeing it was an internal address?

[tsimionescu]

Unless the pictured email client has an absolutely horrible kerning implementation, it is sent from @Godaddy.com. Where did you get the "@gocladdy.com" information from?

[musingsole]

From xref's other post: https://www.wfaa.com/mobile/article/news/godaddyunderfirefor...

https://imgur.com/a/eqrijWx

[tsimionescu]

The photo from the original article is different:

https://imgur.com/a/anfsAsa

I can't access wfaa.com ("Access denied" errors even on /), perhaps they are blocking European traffic?

[llacb47]

That's Tegna for you.

[permo-w]

the second line of the article says it is from [e-mail]. So that’s where

[armada651]

Does it matter if it's an internal address? Any address can be spoofed and some internal addresses could have leaked.

I wouldn't attach any value to the address even with SPF and DCIM, which are often mis-configured.

[iamacyborg]

If GoDaddy are misconfiguring their DKIM records they’ve got bigger problems.

[michaelt]

The apex phishing e-mail is indistinguishable from a legitimate e-mail, except by SPF/DKIM. After all, the apex phishing e-mail is based on a byte-for-byte copy of a legitimate e-mail.

[throwaway3849]

For phishing test links that contain identifiable query parameters, it's easy enough to write a quick script which finds those emails and moves them into the "phishing tests" folder. For those operating in a system which proxies email links, just not checking email is a valid alternative. Just treat the whole well as poisoned.

[toddh]

Usually there's a corporate email address for internal email. Does all godaddy internal email come from godaddy.com? That would be strange.

[tsimionescu]

The email in my company all comes from @<company-name>.com. Why would a company keep a separate domain for internal vs external email? Is that common practice?

[michaelt]

It's rare but not unknown - for example Facebook employees' e-mails are [e-mail] rather than [e-mail] and sometimes facebook send e-mails from [e-mail] ¯\_(ツ)_/¯

[terinjokes]

Facebook's case is likely because they launched a public email service back in 2010.

[the_jeremy]

It's not internal vs external, it's employee vs users (e.g., @google.com vs @gmail.com)

[superseeplus]

That’s an excellent point. Yahoo uses yahoo.com for their public email service. Google uses google.com for their internal (employee) email addresses.

[Macha]

Yahoo consequently does not use yahoo.com for internal email addresses. Even before all the merger activity