Warning signs detected
Legitimate SendGrid mail server hostname frequently abused by phishing campaigns impersonating SendGrid and other brands. Several risk indicators suggest caution. This site might be legitimate — but treat it as unverified until you can independently confirm.
Is wfbttvcx.outbound-mail.sendgrid.net legit or a scam?
Legitimate SendGrid mail server hostname frequently abused by phishing campaigns impersonating SendGrid and other brands.
These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.
Analysis Summary
MT Intelligence
The hostname wfbttvcx.outbound-mail.sendgrid.net belongs to Twilio SendGrid, a 17-year-old legitimate email delivery platform. However, our research found multiple documented phishing campaigns using similar SendGrid outbound subdomains to impersonate SendGrid itself and other organizations. Criminals exploit compromised or malicious customer accounts on SendGrid; because emails originate from real SendGrid infrastructure, they pass authentication checks (SPF/DKIM). The random prefix pattern (wfbttvcx) is standard for SendGrid's shared outbound servers, making it impossible to distinguish legitimate customer mail from abuse at the hostname level. The IP reputation score is low (4/100), and only one abuse report exists, reflecting that SendGrid actively manages its infrastructure—but the documented phishing campaigns prove the platform is a known vector for credential-harvest and brand-impersonation attacks.
Website Preview
Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site.
Web Research Findings
Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for wfbttvcx.outbound-mail.sendgrid.net, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.
- wfbttvcx.outbound-mail.sendgrid.net is a legitimate Twilio SendGrid outbound mail server hostname (IP range 159.183.120.0/24 owned by SendGrid, Inc.).
- Similar SendGrid outbound subdomains (e.g. s.wfbtzhsv.outbound-mail.sendgrid.net, wrqvpkzw.outbound-mail.sendgrid.net, s.wfbtzhst.outbound-mail.sendgrid.net) have been used in multiple documented phishing campaigns impersonating SendGrid, O
- Criminals abuse compromised or malicious SendGrid accounts; emails pass SPF/DKIM because they originate from real SendGrid infrastructure.
- SendGrid publishes guidance on identifying phishing emails that spoof their brand; they are not the originator of the scams but their platform is frequently abused.
- Domain age of 6258 days (~17 years) aligns with SendGrid's long-established legitimate service.
- No direct reports found specifically for the exact prefix "wfbttvcx", but the pattern matches known abuse of SendGrid's shared outbound servers.
- IPinfo confirms the hostname resolves within SendGrid's ASN 11377 infrastructure.
- Netcraftopen
"Received: from s.wfbtzhsv.outbound-mail.sendgrid.net (s.wfbtzhsv.outbound-mail.sendgrid.net [159.183.224.104])"
- LinkedIn / Security Reportopen
"Received: from s.wfbtzhst.outbound-mail.sendgrid.net (s.wfbtzhst.outbound-mail.sendgrid.net [159.183.224.103])"
- Hacker Newsopen
"came from an actual sendgrid server (wrqvpkzw.outbound-mail.sendgrid.net [149.72.49.233])"
- AbuseIPDBopen
"sends phishing spam Received: from wrqvtkxs.outbound-mail.sendgrid.net"
Subdomain of sendgrid.net (Twilio SendGrid, legitimate email delivery platform, domain age 6258 days)
Security research and abuse databases document multiple phishing campaigns using SendGrid outbound mail subdomains (including s.wfbtzhsv.outbound-mail.sendgrid.net, s.wfbtzhst.outbound-mail.sendgrid.net, and wrqvpkzw.outbound-mail.sendgrid.net) to impersonate SendGrid itself and other brands. These campaigns exploited compromised or malicious SendGrid customer accounts. Because emails originate from legitimate SendGrid infrastructure, they pass authentication checks, making them difficult for recipients to identify as phishing. SendGrid publishes guidance on identifying spoofed emails; the platform itself is not the originator of these scams but is frequently abused by attackers. No direct reports were found for the specific prefix 'wfbttvcx', but the pattern matches known abuse of SendGrid's shared outbound servers.
Antivirus Engines
Security Scans
Checked against the major public blocklists used by browsers and security tools — no hits.
Domain & Encryption
Server Reputation
Scam-Type Likelihood
1 scam-type patterns detected
1 of 13 categories showed signals
We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.
- AI analyst tagged this as phishing.
1 of 13 categories showed signals
We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.
- AI analyst tagged this as phishing.
Warning: phishing patterns
This page shows signs of attempting to steal credentials or impersonate a trusted brand.
- Treat wfbttvcx.outbound-mail.sendgrid.net as unverified
Do not enter credentials or send money until you have independently verified the business.
- If you already typed your password — change it now
Change the password on the legitimate site and anywhere else you re-used it. Turn on two-factor authentication. Review recent account activity.
- OpenReport the phishing URL
APWG (Anti-Phishing Working Group) accepts phishing reports at reportphishing@apwg.org. Google Safe Browsing reports help protect other users.
- OpenGet help on the forum
MalwareTips members can help you assess damage and next steps.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
Safety FAQ
Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.
- Our automated security review marked wfbttvcx.outbound-mail.sendgrid.net as suspicious. Several warning signs were detected; it may still turn out legitimate, but you should verify it through independent channels before trusting it with money or credentials.
- wfbttvcx.outbound-mail.sendgrid.net currently scores 55/100 on our trust scale. We found enough warning signals to recommend caution. Verify the site through independent channels before entering credentials or money.
- wfbttvcx.outbound-mail.sendgrid.net is 17.1 years old, registered on 4/20/2009 through MarkMonitor Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
- No. All 92 antivirus engines in our malware network report wfbttvcx.outbound-mail.sendgrid.net as clean.
- No. wfbttvcx.outbound-mail.sendgrid.net is not currently listed on the major browser blocklist feeds that modern browsers use.
- wfbttvcx.outbound-mail.sendgrid.net resolves to an IP operated by Twilio SendGrid in US (usage type: Commercial). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
- We cache results for 24 hours. Signed-in MalwareTips members can trigger a manual rescan at any time using the "Rescan" button on the report page, which re-runs every check from scratch and refreshes this page.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.