Just realized I never raised a question about how bad actors decide which domain names to spoof.
I review DMARC reports quite often, and sometimes I see companies with 300-400 employees having no spoofing attempts, even with p=none and no reporting implemented.
At the same time, I see smaller companies with teams of just 1-5 people experiencing 100+ spoofed emails being distributed every day.
The first thing that comes to mind is that they might register on various websites / leave their emails on shady blogs, leading to email leaks.
But is there any correct answer? Anyone?
Why low-volume spoofing is still a serious risk
We recently had a client facing a minor volume of spoofing emails being distributed from their domain. To address the issue, we recorded a detailed video explaining the problem, outlining the potential consequences for their company, and demonstrating what such spoofing emails could look like using an example from another case.
Their response was: "With such a small number of phishing emails compared to others, it's not a top priority for us right now". When we asked, "What if these emails are highly targeted, aiming to phish your employees?" we received no reply.
Hidden SPF abuse via a look-alike SendGrid domain
While investigating the SPF record for a company, I was surprised to find that even with only Google and SendGrid servers, the SPF DNS lookups exceeded the maximum of 10. Upon further inspection, I discovered that the SPF record included IPs from suspicious servers hidden behind the "include" parameter. Initially, I assumed SendGrid's servers had been compromised.
However, a closer examination revealed that the parameter was not include:sendgrid.net but rather include:sengrid.net. This subtle difference, a missing "D", raises significant concerns.
One of the questions is how such a major service provider like SendGrid didn't own domains that closely resemble their primary one. This oversight can be exploited by malicious actors, leading to severe security implications.
