confirmation-id7904[.]com

On July 29, 2026, analysts observed that confirmation-id7904.com was registered through Hello Internet Corp on June 12, 2026. The domain resolves to the IPv4 address 188.114.96.3 and currently appears on a single known security blocklist, specifically PhishDestroy, which has actively blocked traffic to the host. VirusTotal has scanned the domain and 16 of 91 security vendors returned a positive detection, indicating a consensus among multiple scanners that the site is malicious. The detections are classified as generic phishing, matching the threat type assigned in internal intelligence.

No additional public evidence such as page titles, SSL certificates, or HTTP response codes has been released, so the content and exact phishing lure remain unverified. The limited visibility of the site suggests a short‑lived infrastructure, but the presence on a reputable blocklist and the multi‑vendor VT detections raise the risk to an elevated level. Defenders should add the domain and its resolving IP address to deny‑list rules in firewalls, DNS filtering services, and endpoint protection suites.

Continuous monitoring of the IP reputation and periodic re‑scanning on VirusTotal are advised, as the detection landscape may evolve. Organizations that employ email gateways or web proxies should ensure that traffic to confirmation-id7904.com is blocked, and any credentials submitted to the URL should be considered compromised. The scarcity of further indicators means that threat hunting should focus on lateral movement patterns associated with phishing campaigns originating from the same IP range.