confirmation-id3651[.]com

This domain, confirmation-id3651.com, is flagged as a high-risk credential phishing site specifically targeting Microsoft 365 authentication workflows. Analysis indicates the infrastructure mimics enterprise identity verification portals, likely designed to harvest corporate login credentials through fake O365 challenge-response pages. No direct association with known drainer kits has been confirmed, but the domain naming convention suggests an intent to deceive users into believing they are completing a legitimate Microsoft identity confirmation process.

Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 14/95 security vendors, registration through GMO Internet Group, Inc. d/b/a Onamae.com, and creation on June 23, 2025. The domain appears on one security blocklist and is currently not listed in Google Safe Browsing (GSB) databases. No associated IP address has been publicly attributed at this time, though passive DNS analysis suggests potential hosting through bulletproof providers common to phishing campaigns.

As of the latest verification, confirmation-id3651.com remains active and unresolved. Immediate response actions should include blocking the domain at DNS and web proxy layers, implementing conditional access policies for Microsoft 365 authentication attempts, and deploying indicators of compromise (IOCs) to endpoint detection systems. Despite partial vendor coverage, the remaining risk is classified as high due to the domain's recent registration, active status, and targeted nature against enterprise authentication systems. Organizations are advised to monitor for authentication attempts referencing this domain and conduct retrospective log analysis for prior exposure.