promo-confirm[.]com

Analysis of promo-confirm.com shows that the domain was registered on July 30, 2026 through Fewmoretaps OU d/b/a Trustname.com and is currently active. DNS resolution points to the single IPv4 address 188.114.96.3, and the domain is served by Cloudflare using the nameservers bradley.ns.cloudflare.com and marjory.ns.cloudflare.com. The hosting infrastructure advertises HTTP/3 support, HSTS enforcement, and includes Google Analytics tracking, indicating a modern web stack but providing no indication of benign intent.

The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service, which classifies it as a generic phishing source. VirusTotal has processed the domain with scans from 91 antivirus and URL‑reputation vendors; none of the vendors raised a detection at the time of the scan, though the absence of detections does not constitute a safety guarantee. No additional threat intelligence such as OTX references, Safe Browsing verdicts, or detailed page‑title analysis is available.

Given the recent creation date, the presence on a blocklist, and the association with a known phishing‑blocking feed, the domain should be treated as malicious until further evidence suggests otherwise. Defenders should block outbound connections to 188.114.96.3, add promo-confirm.com to DNS deny lists, and monitor for any traffic patterns that may indicate credential harvesting attempts. Continuous re‑evaluation is advised as new intelligence, such as vendor detections or additional blocklist listings, becomes available.