confirmation-id1724[.]com

The infrastructure analysis shows that confirmation-id1724.com was registered on June 12, 2026 through Atak Domain Bilgi Teknolojileri A.S. The domain resolves to IP address 172.67.131.229, an address associated with a large cloud hosting provider, indicating that the site is likely hosted on a shared service rather than a dedicated server. The domain is currently listed on one public security blocklist and has been blocked by the PhishDestroy sinkhole, demonstrating that at least one upstream protection service has taken mitigation action.

VirusTotal scans report that 15 of 91 security vendors flag the domain as malicious, reinforcing the suspicion of malicious intent. No additional intelligence such as page title, brand target, or specific phishing kit has been published, so the exact content and victim lure remain unknown. Given the recent creation date, active blocklist presence, and multi‑vendor detection, the domain should be considered high‑confidence malicious.

Defenders are advised to add confirmation-id1724.com to DNS and proxy blocklists, monitor traffic to its hosting IP for other suspicious activity, and consider broader Cloudflare IP ranges for temporary traffic filtering if rapid containment is required. Continuous re‑evaluation is recommended as further payload or page analysis becomes available.