confirmation-id2817[.]com

The domain confirmation-id2817.com is currently active and operates as a fake account verification phishing site. Analysis indicates this infrastructure is designed to harvest user credentials through deceptive login portals, mimicking legitimate authentication processes. No specific brand impersonation has been confirmed, but the domain employs generic verification-themed lures to deceive targets. Infrastructure analysis reveals the domain was registered on June 12, 2026, through GMO Internet Group, Inc. d/b/a Onamae.com. It resolves to the IP address 188.114.97.3 and is protected by Cloudflare, with HTTP/3 and Cloudflare Browser Insights detected as underlying technologies. Security vendors have flagged this domain in 16 of 95 VirusTotal scans, while it appears on two distinct security blocklists. AlienVault OTX records show the domain in six threat intelligence pulses, further corroborating its malicious classification. This domain remains active and poses an elevated risk to users encountering verification-themed phishing lures. Organizations and individuals are advised to block the domain and its resolving IP at the network perimeter. Endpoint protection should be updated to include this indicator, and users should be educated on recognizing generic verification scams. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats.