confirmation-id7903[.]com

Analysis of confirmation-id7903.com indicates an active credential harvesting phishing domain registered on June 12, 2026, through Hello Internet Corp. As of July 29, 2026, the domain resolves to the IP address 188.114.97.3 and appears on one security blocklist, specifically PhishDestroy. VirusTotal data shows that 16 out of 91 security vendors have flagged this domain as malicious, suggesting moderate detection coverage but not universal consensus. The domain's infrastructure and naming convention—using 'confirmation-id' followed by a numeric string—align with patterns commonly observed in phishing campaigns designed to impersonate account verification or authentication processes.

No specific brand target or phishing kit has been identified in the available data, and the exact content of the site remains unanalyzed. The domain's registration details and hosting provider do not reveal additional attribution beyond the registrar, Hello Internet Corp. Defenders are advised to treat this domain as elevated risk, particularly for credential theft attempts.

Network-level blocking at the IP 188.114.97.3 and domain level is recommended, alongside monitoring for related subdomains or newly registered lookalike domains. Further investigation into the hosting infrastructure and associated campaigns may provide additional context, though no direct links to known threat actors or clusters have been established at this time.