From what you've described, this looks far more like an aggressive pattern that triggered every security protocol at once, rather than "domain warming being a scam."
Ramping up from zero to decent volume across nine fresh domains in three weeks, then blasting a cold push on day one - that'll look suspicious regardless of what MXToolbox reports. A green light there simply means the DNS records exist, it doesn't mean inbox providers trust you an inch.
manual sending can actually be more damaging than a sequenced campaign if your timing and templates are overly repetitive. Same subject lines, near-identical body copy, tight send windows, brand new domains, and a heavy concentration of cold addresses - that's a recipe for triggering every spam filter in sight.
Worth double-checking each domain against Spamhaus and similar blocklists, confirming you have a DMARC record with an actual policy (not just SPF and DKIM), and auditing the sending IP reputation from your ESP side.
Also, don't underestimate the copy itself. If it screams "cold sales email" with tracking pixels, links, and possibly images, spam filters won't care that you "warmed" the domains. Volume, content, and brand new infrastructure combined can light you up instantly, no matter how clean the setup looked on paper.