I'd feel pretty stupid getting worked up about something only to realize that getting worked up about it was used against me.

I'm writing this because for a moment I did get worked up and then had the slow realization it was a phishing attack, slightly before the article got to the point.

Anyways, I think the clickbait is kindof appropriate here because it rather poignantly captures what is going on.

but that would be clear and very boring. nobody would read your blog then. A headline that very obviously implies Sendgrid the company supports ICE, and so much so that they are emailing all their customers about it, clicks galore. Well done.

In any case, I revised the title to "SendGrid isn’t emailing you about ICE or BLM. It’s a phishing attack."

Maybe someone can edit the title of the submission on HN accordingly?

I thank the author for getting me this way, as I would have likely fallen for the unsubscribe trick.

And/or, long-press or right-click on any link to inspect the linked domain.

I do love the idea of voter registration oscillating back and fourth at 20 minutes intervals forever. Would make voting in the primaries way more exciting as the voter base kept flipping.

https://www.pay.gov/public/form/start/23779454

I used to run IT for a medium company. The amount of times I saw this with various SaaS companies was troubling. We had hundreds of services some as small as a single manager that demanded X and company wide tools. It was frequently a several months long hassle to get them to stop billing us when we cut ties with them. I wish I kept personal records now it was a minority but definitely in the 15%'ish range.

I suspect that once the sendgrid account is compromised, they then send out these phishing emails, hoping to compromise _other_ sendgrid accounts to look for password overlap and/or keep the flow going.

yes

I think you're about 20 years behind the times if you think they don't.

There are a whole lot of problems with it when you start pressing the finer details like you list. For example, just look at the legit emails banks send out. They will tell you not to click links claiming to be your bank, then include links (claiming to be your bank) for more information.

Simply put the rules block too much corporate email because people that write corporate email do lots of dumb things with the email system.

The most essential check is SPF and DKIM which authenticate if the message has come from an authorized server. The problem is that most mail services are too lenient with mismatched sender identification. On one hand, people would be quite vocal about their mail provider sending way too much legitimate (but slightly misconfigured) mail to the spam folder. However it allows situations like to happen where the FROM header, the "From:" address, and the return path are all different.

Most mail systems have several stages of filters, and the first ones (checking authentication) are quite basic. After that, attachments, links, and contents are checked for known malware. Machine learning might kick in after this, if certain criteria are met. Mail security is very complicated and works well except for the times it falls flat on its face like this.

https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

It's better to focus on more systematic solutions. There exist a lot of them, SPF, DKIM, Recipient mail filtering (Your mail provider).

The screenshotted emails don't even do anything tricky like spoofing the sender address, it looks like "Sent from no-reply@theraoffice.com". If it spoofed the domain it would have been caught by SPF/DKIM.

Most of the time the user doesn't need to do much, you can just be weary of sender domains, and report the email as phishing and help blacklist that specific IP address/domain. Similar to how in medicine sometimes the physician tells you to drink water and rest, no medicine needed, just let the immune system do its thing.

I only used a SendGrid account briefly, as a potential backup to my current outgoing transaction mail provider. Sent exactly 5 test emails I think.

The ICE one this morning gave me pause, but only about 2s before I deleted it and moved on with my busy day of reading HN posts.