Sendgrid fake name transfer authorization

Kuffy · Sep 22, 2017

Yesterday I initiated a transfer from one registrar to another. The registrant email addy was one on my BuyAny.com domain, and I used thunderbird to read the mail. When I looked at the transfer confirmation link, it appeared to be a standard Name Silo one. However, Thunderbird gave me a scam alert warning, and a quick check revealed that it had been cloaked and the real destination was a long url on sendgrid.net. Copy and paste allowed me to confirm the transfer in the normal way.

Now the question? Does anyone know about this scam? Is it my mail server that has been hacked, or is it a problem with the losing registrar?

anantj · Sep 22, 2017

sendgrid provides email tracking. it *might* not be a scam. @namesilo can confirm

Kuffy · Sep 22, 2017

I looked ata a gmail transfer, and the link in the mail there is uncloaked. I guess that's bad news, as my mail server may be compromised.

anantj · Sep 22, 2017

What do you mean? What's gmail transfer?

Kuffy · Sep 22, 2017

anantj said:
What do you mean? What's gmail transfer?

Using a gmail addy as the registrant email address.

anantj · Sep 22, 2017

Okay. I don't, atm, believe that your e-mail or mailserver is compromised. Who's the sender of the e-mail (Losing registrar or Namesilo, the latter, I gather is the gaining registrar)?

Kuffy · Sep 22, 2017

OnLineNIC ---> NameSilo

I'll try another transfer to a different thunderbird account in a minute to see what happens.

Another problem is that gmails arrive pretty quickly, but those to my names can take an hour or more, and sometimes I have to request a resend. Other mails to my server boxes are pretty instant, so I don't think it is a hosting problem.

Kuffy · Sep 22, 2017

Update -

I used the email associated with my casino names management site, and the first mail didn't arrive. A request for a re-send produced a response in a reasonable time. The scam warning was in this one as well because of the cloaking. This is a different box on a different domain, but still in the same hosting plan.

I guess the next stage is an email to the losing registrar to ask if they are messing around with the links. It's really annoying, and it has wasted quite a bit of my time researching the problem.

anantj · Sep 22, 2017

I'm pretty sure that the sendgrid link is purely to track if the link was used and/or clicked, from where and other similar associated analytics.

anantj · Sep 22, 2017

Kuffy said:
The scam warning was in this one as well because of the cloaking

I'm not sure of the scam warning is only because of cloaking. I've seen legit e-mails from legit senders also display the scam warning (For example, from my legit bank). Thunderbird's scam warning is pretty crappy

ETA: I'm also a daily Tbird user...

Kuffy · Sep 22, 2017

Well I need to find out why they are tracking mail to my servers, and not to gmail. I would have thought that a gmail addy was more suspect, than a box on a 14 year old name with the same registrant for that period.

xynames · Sep 22, 2017

Sendgrid is great I use them for multiple applications, on forums I run, and such.

Depending on your Sendgrid settings, the URL may be a long one created by Sendgrid or the actual URL. The "long URL" is not indicative of a scam if it is Sendgrid that has created the URL, just the way Sendgrid works, a service/method they provide for tracking.

To make the URLs remain without change, access Sendgrid Tracking
Settings/Tracking/Click Tracking
and inactivate Click Tracking so that the URLs remain intact.

anantj · Sep 22, 2017

Kuffy said:
Well I need to find out why they are tracking mail to my servers, and not to gmail. I would have thought that a gmail addy was more suspect, than a box on a 14 year old name with the same registrant for that period.

They are not. AFAIK, Gmail made a change to strip out a lot of tracking related elements from e-mails. Not sure if that included tracking links as well. Or perhaps, gmail is displaying the actual text as the link as well. Check the original/raw e-mail to confirm in both cases

Kuffy · Sep 22, 2017

I don't really care how reliable sendgrid is, I don't want my registrar to send transfer confirmations through a third party that I don't know. In my opinion, it's another reason to leave that registrar.

Thanks to everybody for clearing up the doubts in this matter. It looks as if I should make sure I use the gmail address for all transfers away from them.

Sendgrid fake name transfer authorization

Name StagTop Member

Top Member

Name StagTop Member

Top Member

Name StagTop Member

Top Member

Name StagTop Member

Name StagTop Member

Top Member

Top Member

Name StagTop Member

XYNames.comTop Member

Top Member

Name StagTop Member

Similar threads

We're social

Pinned

Appreciation

Agreement