A SendGrid Phish, Signed by SendGrid, on a 15-Minute Domain

A phishing credential-harvesting message impersonating a SendGrid subscription receipt was genuinely relayed and signed by SendGrid infrastructure so authentication passed; the malicious call-to-action resolved to a typosquatted domain (myconnsend-grid.com) registered 15 minutes 40 seconds before delivery and scanned as Clean because it had no history. Detection hinged on non-authentication signals: a syntactically invalid From header (noreply@sendgrid with no TLD), generic billing copy with no account details, first-time sender status, and behavioral scoring (Themis 86% credential theft), and the incident was automatically resolved as phishing.