Source of http://t.sigopn03.com/… tracking-style link in an email signature?

Question

A coworker received a Bounced Email notification when trying to send a message from her personal Gmail to our GoDaddy-based support email: the error message included "This message has been rejected due to content judged to be spam by the internet community IB212".

I noticed that the hyperlinks in her email signature--two links to our websites--included something that looks like a tracking link. Example link: http://t.sigopn03.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XYg4XrjvYVdDNqq5wLKJ8W8rByXx56dLfSf1Fh9j-02?t=http%3A%2F%2F[ website]%2F&si=6113506899787776&pi=d51a010b-8a97-4712-a6bd-40ba154663e3

Our GoDaddy email server was rejecting messages with the signature, but new messages from her came through fine when signature is removed.

She does not to her knowledge use any sort of analytics or click-tracking software, and I'm wondering where this hyperlink addition came from. I am not finding any overt references to this http://t.sigopn03.com site in google results, though it does appear on a handful of email transcripts with sig link.

Anybody know anything about t.sigopn03 or its affiliation? Something to be concerned about?

Answer 1

Quick lookup shows domain is owned by MARKMONITOR, INC.

https://en.wikipedia.org/wiki/MarkMonitor

MarkMonitor Inc. is an American software company founded in 1999. It develops software intended to protect corporate brands from Internet counterfeiting, fraud, piracy, and cybersquatting. It also develops and publishes reports on the prevalence of brand abuse on the Internet. MarkMonitor acquired AllDomains in 2001 and DtecNet in 2010. MarkMonitor was then purchased by Thomson Reuters in 2012. In 2016, the IP division of Reuters, including MarkMonitor was sold to two venture capital companies, under the new parent company "Clarivate Analytics".