3 ms·

Well, I've tried contacting sendgrid about phishing emails that look like they're from @sendgrid.com , using their own server. The SPF records match, so it isn'

Well, I've tried contacting sendgrid about phishing emails that look like they're from @sendgrid.com , using their own server. The SPF records match, so it isn't marked as junk mail. It's similar to the github pages exploit from years ago, which is why we now have github.com and gitub.io The purpose of these mails is of course to get credentials and spam some more. At first I checked for a bounty, but as this is a "configuration error" (SPF), there is no bounty. Then I sent it by mail, but yeah.. No reply.

nodesocket 6y ago
Can you elaborate how a 3rd party is able to send e-mail from @sendgrid.com?
- jbverschoor 6y ago
  Simple. Their ip addresses of their client/guest-servers are whitelisted in the SPF records. So anyone can impersonate them. Not 100% sure if that was the case now, as I can't find the email anymore, but I've been getting them from both sendgrid and mailgun. Mailgun's SPF (was at least): v=spf1 include:spf1.mailgun.org include:spf2.mailgun.org include:_spf.google.com include:aspmx.pardot.com include:mail.zendesk.com include:spf.mailjet.com ~all spf1.mailgun.org: v=spf1 ip4:104.130.122.0/23 ip4:146.20.112.0/26 ip4:141.193.32.0/23 ip4:161.38.192.0/20 ~all v=spf1 ip4:209.61.151.0/24 ip4:166.78.68.0/22 ip4:198.61.254.0/23 ip4:192.237.158.0/23 ip4:23.253.182.0/23 ip4:104.130.96.0/28 ip4:146.20.113.0/24 ip4:146.20.191.0/24 ip4:159.135.224.0/20 ip4:69.72.32.0/20 ~all In the mailgun case I received mails from for example 198.61.254.24 with from: invoice@mailgun.com This is actually part of a bigger issue, where lots of people use the same email service to send out emails. In theory that should work with gmail or office365, but iirc gmail forces your from sometimes, and google+ms probably thought about this, right? ;)
  - monadic2 6y ago
    I'm surprised they give clients access to their own DKIM.
    - perennate 6y ago
      It doesn't pass DKIM. But the fact that it's sent through Sendgrid's platform gives the e-mail credibility. Because no one expects Sendgrid to allow random customers to set e-mail (not necessarily envelope) from address to @sendgrid.com.
      - monadic2 6y ago
        Based on my experience with sendgrid it's par for the course.
- XCSme 6y ago
  Someone sent spam emails using my domain name, so I looked a bit into it and made a summary of what I learned: https://www.usertrack.net/blog/stop-others-use-your-domain-emails https://www.usertrack.net/blog/stop-others-use-your-domain-e...
perennate 6y ago
Same -- I got several e-mails with subject "The following services failed to auto-renew and are about to expire" that I almost believed were real because they came from an actual sendgrid server (wrqvpkzw.outbound-mail.sendgrid.net [149.72.49.233]). If SendGrid can't develop simple filters to deter phishing e-mails sent through their platform targeting their own service, then obviously they're going to end up with a lot of users being hacked. I mean seriously, why would an e-mail provider like this allow e-mails to be sent from "renewaldepartment@sendgrid.com" and "support@Sendgrid.com"??

nodesocket 6y ago

Can you elaborate how a 3rd party is able to send e-mail from @sendgrid.com?

jbverschoor 6y ago
Simple. Their ip addresses of their client/guest-servers are whitelisted in the SPF records. So anyone can impersonate them. Not 100% sure if that was the case now, as I can't find the email anymore, but I've been getting them from both sendgrid and mailgun. Mailgun's SPF (was at least): v=spf1 include:spf1.mailgun.org include:spf2.mailgun.org include:_spf.google.com include:aspmx.pardot.com include:mail.zendesk.com include:spf.mailjet.com ~all spf1.mailgun.org: v=spf1 ip4:104.130.122.0/23 ip4:146.20.112.0/26 ip4:141.193.32.0/23 ip4:161.38.192.0/20 ~all v=spf1 ip4:209.61.151.0/24 ip4:166.78.68.0/22 ip4:198.61.254.0/23 ip4:192.237.158.0/23 ip4:23.253.182.0/23 ip4:104.130.96.0/28 ip4:146.20.113.0/24 ip4:146.20.191.0/24 ip4:159.135.224.0/20 ip4:69.72.32.0/20 ~all In the mailgun case I received mails from for example 198.61.254.24 with from: invoice@mailgun.com This is actually part of a bigger issue, where lots of people use the same email service to send out emails. In theory that should work with gmail or office365, but iirc gmail forces your from sometimes, and google+ms probably thought about this, right? ;)
- monadic2 6y ago
  I'm surprised they give clients access to their own DKIM.
  - perennate 6y ago
    It doesn't pass DKIM. But the fact that it's sent through Sendgrid's platform gives the e-mail credibility. Because no one expects Sendgrid to allow random customers to set e-mail (not necessarily envelope) from address to @sendgrid.com.
    - monadic2 6y ago
      Based on my experience with sendgrid it's par for the course.
XCSme 6y ago
Someone sent spam emails using my domain name, so I looked a bit into it and made a summary of what I learned: https://www.usertrack.net/blog/stop-others-use-your-domain-emails https://www.usertrack.net/blog/stop-others-use-your-domain-e...

perennate 6y ago

Same -- I got several e-mails with subject "The following services failed to auto-renew and are about to expire" that I almost believed were real because they came from an actual sendgrid server (wrqvpkzw.outbound-mail.sendgrid.net [149.72.49.233]). If SendGrid can't develop simple filters to deter phishing e-mails sent through their platform targeting their own service, then obviously they're going to end up with a lot of users being hacked. I mean seriously, why would an e-mail provider like this allow e-mails to be sent from "renewaldepartment@sendgrid.com" and "support@Sendgrid.com"??