Newly Identified Domains Likely Linked to Continued Activity from PoisonSeed E-Crime Actor

DomainTools Investigations identified a set of malicious domains registered since 01 June 2025 that are likely linked to the PoisonSeed e-crime actor, with the majority referencing SendGrid and others co-hosted on IPs alongside SendGrid-spoofing domains. These domains display fake Cloudflare CAPTCHA interstitials and contain fake Cloudflare Ray ID data, in a bid to lend legitimacy before redirecting targeted users to phishing pages designed to harvest enterprise credentials.

Mimecast Threat Research team published a blog describing similar activity, including phishing campaigns impersonating SendGrid to deceive providers’ users, and our analysis points to PoisonSeed as the likely actor behind these domains based on registration patterns and interstitial tactics.

We did not identify specific targets, though public information indicates PoisonSeed’s historical focus on cryptocurrency platforms and enterprise environments, and our assessment suggests continued use of TTPs historically linked to SCATTERED SPIDER. Editor’s note: research for this article was conducted in July 2025, with conclusions based on information available at that time. 9 October 2025.