confirmation-id79520[.]com

The domain confirmation-id79520.com was registered on June 12, 2026 through Atak Domain Bilgi Teknolojileri A.S. Early infrastructure analysis shows that the domain resolves to the IPv6 address 2606:4700:3030::ac43:d70c, which is hosted on a cloud service that is also used by other malicious actors. The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that threat‑intel aggregators have observed malicious use.

VirusTotal reports that 11 of 91 security vendors flagged the domain, providing additional corroboration of its malicious nature. No public SSL certificate details, HTTP status codes, or page‑title information have been released, so the exact content served by the site remains unverified. The limited visibility suggests a recent deployment aimed at short‑lived phishing campaigns.

Defenders should immediately add confirmation-id79520.com to URL and DNS blocklists, monitor outbound traffic for connections to the IPv6 address 2606:4700:3030::ac43:d70c, and enforce email filtering rules that detect links to this domain. Continuous re‑scanning on VirusTotal and periodic checks against blocklist updates are recommended to capture any changes in the domain's threat profile.