Why Some Domains Are Spoofed More Than Others
Summary
An email-security consultant describes uneven spoofing volumes and a case where an SPF record included look-alike sengrid[.]net, bringing in suspicious IPs and exceeding the 10-DNS-lookup limit. Malicious use is a concern, not established.
Key points
- The author says some small companies receive more than 100 spoofed emails daily, while some companies with 300–400 employees see no attempts; these are personal observations.
- A client deprioritized low-volume spoofing, although targeted phishing could still pose a risk.
- In one SPF review, the author found include:sengrid[.]net rather than include:sendgrid[.]net; the record reportedly exceeded the 10-DNS-lookup limit and included IPs from suspicious servers.
- The article raises the possibility that the look-alike domain could be exploited but does not establish who controlled it or confirm malicious use.
Article Details
- Topic
- Email domain spoofing and hidden SPF abuse through a look-alike SendGrid domain
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sengrid[.]net | Look-alike domain used in an SPF include that exposed suspicious servers; the article says this typo can be exploited by malicious actors. |