DomainMediumSignal 79/100

`server9-sendgrid.net`

First Seen

Mar 31, 2025

Last Seen

May 3, 2026

Mar 31

First Seen

449d ago

May 3

Last Seen

50d ago

Reports

source reports

79%

Confidence

medium

Found in 9 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.

Domain Name

Malicious domain used for C2, phishing, or malware distribution.

MISP Category

Network Activity

Confidence

79%

Signal Score

79 / 100

IDS Rule

Threat Context

MITRE ATT&CK TTPs

70 techniques

Feed Intelligence Summary

9 reports79% confidence

Source reports

79%

Confidence score

Category tags

abuseaccount compromiseaccount discoveryaccount profilingaccount takeoveractive scanactive scanningakamaiakamai sendgridapi abusebackbad reputationbankingbotnetbotnet activitybrute forcebrute force attackbrute force attacksbulk emailbulk email spamclickclick-based attackcloudflare turnstile bypasscoinbasecommand and controlcompromised credentialscredential accesscredential harvestingcredential phishingcredential stuffingcredential theftcredit card servicescrmcrm exploitationcrm platform compromisecryptocryptochameleoncryptocurrencycryptocurrency fraudcryptocurrency threatscryptojackingcustomer relationship managementdata exfiltrationdata store exposuredgadistributed attacksexploitation activityfake login pagefinancefinance and insurancefinancial servicesfinancial technologyftp brute forcehttp probinghubspotidentity & access exploitationindicatorinformation technologyinfrastructure discoveryinjection activityit infrastructureledgermailgunmalicious linksmalicious softwaremalwaremultiple threat actorsnetworknetwork scanningotp bypasspassword attackspayment processingphishingphishing attackphishing campaignpoisonseedprocess injectionpushransomwarereconnaissanceremote accessremote servicesresearchedresource hijackingscams & fraudscattered spiderscatterred spidersecurity operationsseed phraseseed phrase poisoningseed phrase theftsilent pushsmtp probingsocial engineeringsoftware developmentspamssh attackstatesupply chainsupply chain attacksystem discoveryt1003t1003.001t1018t1021t1021.001t1053t1055t1059t1059.001t1071t1071.001t1076t1078t1078.004t1083t1110t1110.001t1110.002t1110.003t1110.004t1114t1187t1189t1190t1195t1195.001t1195.002t1199t1204.001t1204.002t1486t1495t1496t1499t1499.002t1499.003t1539t1555t1555.003t1563t1565t1566t1566.001t1566.002t1566.003t1567t1583t1583.001t1583.002t1583.004t1584t1584.001t1585t1586t1586.001t1586.002t1587t1588t1588.002t1589t1589.002t1591t1595t1595.001t1595.002t1595.003t1598t1598.003t1608t1608.001targeted attackthreat actorthreat intelligencetor nodetroy hunttyposquattingunknown malware distributionupgradeuser executionvalidinwealth managementweb application attackwhoiszoho

Activity Timeline

1 total obs

May 3May 3

Threat Activity Heatmap

· Peak: 2026-05-03

Less

Mon

Wed

Fri

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Jan

Feb

Mar

Apr

May

Jun

24h

Dormant

30d

Dormant

3mo

Minimal

Threat ScoreHigh Risk

SIGNAL

Signal Score

79%

Confidence

Reports

First seenMar 31, 2025

Last seenMay 3, 2026

VirusTotal

Not checked

WHOIS

description: Latest IOCs emerged in 2025
domain rank: -1
raw: Create date: 2025-03-20 00:00:00 Domain name: server9-sendgrid.net Domain registrar id: 3765 Domain registrar url: http://www.nicenic.net Expiry date: 2026-03-20 00:00:00 Name server 1: ivy.ns.cloudflare.com Name server 2: ace.ns.cloudflare.com Query time: 2025-03-22 11:10:49 Registrant company: 1f8f4166599d23ee Registrant country: United Arab Emirates Registrant email: 9253e579452ffad5s@ Registrant state: 2dd048e0bc5895a5 Update date: 2025-03-20 00:00:00
references: https://www.silentpush.com/blog/poisonseed/, https://www.validin.com/blog/pulling_threads_on_phishing_campaign/, IOC.pdf, https://www.silentpush.com/blog/poisonseed/#Continuing-to-Track-PoisonSeed
subdomains count: 0

`server9-sendgrid.net`

MITRE ATT&CK TTPs

Feed Intelligence Summary

Activity Timeline

Threat Activity Heatmap

VirusTotal

WHOIS

Export & API

IOC Journey