confirmation-id4611[.]com

Analysis of confirmation-id4611.com indicates an active phishing domain targeting PayPal users, classified as elevated risk. The domain was registered on June 12, 2026, through Atak Domain Bilgi Teknolojileri A.S., a registrar frequently associated with fraudulent infrastructure. As of July 29, 2026, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 14 of 91 security vendors on VirusTotal, confirming its malicious classification. No additional details regarding hosting provider, autonomous system number, or SSL certificate issuer are currently available, limiting further infrastructure attribution.

The domain's registration age—just over six weeks at the time of assessment—aligns with common phishing campaign timelines, where domains are rapidly deployed and discarded. The absence of widespread blocklist adoption suggests the campaign may still be in an early or targeted phase, though the VirusTotal detection rate provides concrete evidence of its malicious intent. Defenders should treat this domain as a confirmed phishing threat, particularly for PayPal-related credential harvesting or account takeover attempts.

Organizations are advised to block access to confirmation-id4611.com at the network perimeter, update endpoint protection signatures, and monitor for related indicators of compromise. Given the domain's recent creation and active status, further monitoring of associated infrastructure—such as IP addresses, nameservers, or newly registered sibling domains—is recommended to preempt potential follow-on attacks. No evidence of takedown or sinkholing has been observed as of this report.