Four Days Old, Fully Authenticated: CEO Coaching International Impersonation Targets a Sports Technology Company
ID: 7d67060a-f69e-5671-a962-4e421c75c283
STIX ID: report--7d67060a-f69e-5671-a962-4e421c75c283
Feed Name: IRONSCALES
**TL;DR:** Attackers registered the lookalike domain `ceo-coachinginc.com` on 2026-03-06 and, four days later, sent an invoice-fraud email impersonating CEO Coaching International. The message used a fabricated CPA persona and collections-pressure language, authenticated via an unrelated SendGrid signing domain (DKIM/SPF/DMARC passed but not aligned), included attacker Reply-To addresses (`[email protected]`, `[email protected]`), and contained inconsistencies in a forged prior thread; IRONSCALES flagged the message at 63% confidence and highlighted the new-domain + domain-mismatch signals as key detection points.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.