{"id":3589,"date":"2018-08-24T00:25:59","date_gmt":"2018-08-24T00:25:59","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=3589"},"modified":"2018-08-24T00:25:59","modified_gmt":"2018-08-24T00:25:59","slug":"phishing-emails-now-using-sendgrid-for-url-rewrites","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites","title":{"rendered":"Phishing Emails now using SendGrid for URL ReWrites"},"content":{"rendered":"<p>Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below:\u00a0<\/p><p style=\"padding-left: 30px;\"><br \/><em>I have been trying to send you this file, but it failed with attaching them to my email. I managed to upload them here. The document is password protected for confidentiality. You may be required to sign in to view.<\/em><br \/><br \/><em>View Here &lt;<a href=\"https:\/\/protect-au.mimecast.com\/s\/XpIZCMwvM2c2DNQHwIqAQ?domain=u8062662.ct.sendgrid.net\" target=\"_blank\" rel=\"noopener noreferrer\" data-auth=\"NotApplicable\">https:\/\/u8062662.ct.sendgrid.net\/wf\/click?upn=wZQTK0j1og7ZpMJhH8Ud1KVnbiPHM9y73Xakn2Kz-2FW3NjeIbG2SHvoQBr-2FU18gy0sWZ8XmNWnZXVIwYoPeDbMdKFtXGpU-2FkCKJt7n9ht0-2Bc-3D_5kx02phTxyE6nAkdmbPR-2BLnKNuh-2FMh-2Fnzaqek3PlNNGNn5K7iZReVzccFSICLkn2TWbvJrH-2Bw-2BE7xgHn2ty-2B1BSOsEXhaW-2Fe1ryw1S4JCO1SZ5Cc96DNVFrgvKTCexkvDBOvJEZat1Xu3mo-2F-2Bg54FPgHa7ASkej2pIVyR-2BRlCbquUGTUk4YBF0lmrI20ZPDbWrW-2Fob7Pfi5neeYJCNhBDw-2FFhGqmFj4h8u6mNpuZg9g-3D<\/a>&gt;<\/em><\/p><p>&nbsp;<\/p><p>Sendgrid is used for mass emails and people use sendgrid to track clicks. This domain is also never going to be blocked or marked as an issue<\/p><p>The link actually redirects to here :\u00a0https:\/\/beautifulbeanfootage.com\/box\/Login.php?sslchannel=true which is a Phish page pretending to be box.com<\/p><p>&nbsp;<\/p><p id=\"MGJOGHE\"><img loading=\"lazy\" decoding=\"async\" width=\"2673\" height=\"1429\" class=\"alignnone size-full wp-image-3590  img-responsive\" src=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/08\/img_5b7f5028006b6.png\" alt=\"\" srcset=\"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/08\/img_5b7f5028006b6.png 2673w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/08\/img_5b7f5028006b6-300x160.png 300w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/08\/img_5b7f5028006b6-768x411.png 768w, https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/08\/img_5b7f5028006b6-1024x547.png 1024w\" sizes=\"auto, (max-width: 2673px) 100vw, 2673px\" \/><\/p>","protected":false},"excerpt":{"rendered":"<p>Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2645,2644],"class_list":["post-3589","post","type-post","status-publish","format-standard","hentry","category-research","tag-phishing","tag-sendgrid"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.8 - aioseo.com -->\n\t<meta name=\"description\" content=\"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"paris\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.8\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Welcome to Pariswells.com |\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com\" \/>\n\t\t<meta property=\"og:description\" content=\"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2018-08-24T00:25:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2018-08-24T00:25:59+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#article\",\"name\":\"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com\",\"headline\":\"Phishing Emails now using SendGrid for URL ReWrites\",\"author\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/author\\\/paris#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/wp-content\\\/uploads\\\/2018\\\/08\\\/img_5b7f5028006b6.png\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites\\\/#articleImage\",\"width\":2673,\"height\":1429},\"datePublished\":\"2018-08-24T00:25:59+00:00\",\"dateModified\":\"2018-08-24T00:25:59+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#webpage\"},\"articleSection\":\"Research, phishing, sendgrid\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/pariswells.com\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/category\\\/research#listItem\",\"name\":\"Research\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/category\\\/research#listItem\",\"position\":2,\"name\":\"Research\",\"item\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/category\\\/research\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#listItem\",\"name\":\"Phishing Emails now using SendGrid for URL ReWrites\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#listItem\",\"position\":3,\"name\":\"Phishing Emails now using SendGrid for URL ReWrites\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/category\\\/research#listItem\",\"name\":\"Research\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/#organization\",\"name\":\"Welcome to Pariswells.com\",\"url\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/author\\\/paris#author\",\"url\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/author\\\/paris\",\"name\":\"paris\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/93b8ee3f592ac401167f870452bd82d43de80152cd3524e2853403658ada9984?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"paris\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#webpage\",\"url\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites\",\"name\":\"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com\",\"description\":\"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/research\\\/phishing-emails-now-using-sendgrid-for-url-rewrites#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/author\\\/paris#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/author\\\/paris#author\"},\"datePublished\":\"2018-08-24T00:25:59+00:00\",\"dateModified\":\"2018-08-24T00:25:59+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/\",\"name\":\"Welcome to Pariswells.com\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/pariswells.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com","description":"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I","canonical_url":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#article","name":"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com","headline":"Phishing Emails now using SendGrid for URL ReWrites","author":{"@id":"https:\/\/pariswells.com\/blog\/author\/paris#author"},"publisher":{"@id":"https:\/\/pariswells.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/pariswells.com\/blog\/wp-content\/uploads\/2018\/08\/img_5b7f5028006b6.png","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites\/#articleImage","width":2673,"height":1429},"datePublished":"2018-08-24T00:25:59+00:00","dateModified":"2018-08-24T00:25:59+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#webpage"},"isPartOf":{"@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#webpage"},"articleSection":"Research, phishing, sendgrid"},{"@type":"BreadcrumbList","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog#listItem","position":1,"name":"Home","item":"https:\/\/pariswells.com\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog\/category\/research#listItem","name":"Research"}},{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog\/category\/research#listItem","position":2,"name":"Research","item":"https:\/\/pariswells.com\/blog\/category\/research","nextItem":{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#listItem","name":"Phishing Emails now using SendGrid for URL ReWrites"},"previousItem":{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#listItem","position":3,"name":"Phishing Emails now using SendGrid for URL ReWrites","previousItem":{"@type":"ListItem","@id":"https:\/\/pariswells.com\/blog\/category\/research#listItem","name":"Research"}}]},{"@type":"Organization","@id":"https:\/\/pariswells.com\/blog\/#organization","name":"Welcome to Pariswells.com","url":"https:\/\/pariswells.com\/blog\/"},{"@type":"Person","@id":"https:\/\/pariswells.com\/blog\/author\/paris#author","url":"https:\/\/pariswells.com\/blog\/author\/paris","name":"paris","image":{"@type":"ImageObject","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/93b8ee3f592ac401167f870452bd82d43de80152cd3524e2853403658ada9984?s=96&d=mm&r=g","width":96,"height":96,"caption":"paris"}},{"@type":"WebPage","@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#webpage","url":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites","name":"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com","description":"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/pariswells.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites#breadcrumblist"},"author":{"@id":"https:\/\/pariswells.com\/blog\/author\/paris#author"},"creator":{"@id":"https:\/\/pariswells.com\/blog\/author\/paris#author"},"datePublished":"2018-08-24T00:25:59+00:00","dateModified":"2018-08-24T00:25:59+00:00"},{"@type":"WebSite","@id":"https:\/\/pariswells.com\/blog\/#website","url":"https:\/\/pariswells.com\/blog\/","name":"Welcome to Pariswells.com","inLanguage":"en-US","publisher":{"@id":"https:\/\/pariswells.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"Welcome to Pariswells.com |","og:type":"article","og:title":"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com","og:description":"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I","og:url":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites","article:published_time":"2018-08-24T00:25:59+00:00","article:modified_time":"2018-08-24T00:25:59+00:00","twitter:card":"summary","twitter:title":"Phishing Emails now using SendGrid for URL ReWrites | Welcome to Pariswells.com","twitter:description":"Recently had a user receive an email that got past multi Spam protection. The issue was the sender had actually been hacked and they were using his email service to spam all his contacts with the below: I have been trying to send you this file, but it failed with attaching them to my email. I"},"aioseo_meta_data":{"post_id":"3589","title":null,"description":null,"keywords":null,"keyphrases":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"location":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2020-12-21 05:33:27","updated":"2022-09-17 14:36:32","primary_term":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/pariswells.com\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/pariswells.com\/blog\/category\/research\" title=\"Research\">Research<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tPhishing Emails now using SendGrid for URL ReWrites\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/pariswells.com\/blog"},{"label":"Research","link":"https:\/\/pariswells.com\/blog\/category\/research"},{"label":"Phishing Emails now using SendGrid for URL ReWrites","link":"https:\/\/pariswells.com\/blog\/research\/phishing-emails-now-using-sendgrid-for-url-rewrites"}],"_links":{"self":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/comments?post=3589"}],"version-history":[{"count":1,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3589\/revisions"}],"predecessor-version":[{"id":3591,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/posts\/3589\/revisions\/3591"}],"wp:attachment":[{"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/media?parent=3589"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/categories?post=3589"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pariswells.com\/blog\/wp-json\/wp\/v2\/tags?post=3589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}