confirmation-id1785[.]com

Analysis of confirmation-id1785.com shows the domain was registered on June 12 2026 through Atak Domain Bilgi Teknolojileri A.S. The name resolves to IP address 104.21.96.1, which is hosted on the Cloudflare network. The domain appears on one public blocklist and is listed by the PhishDestroy sinkhole as malicious.

VirusTotal scans have returned 15 detections out of 91 submitted security vendors, indicating that a notable portion of scanners consider the domain malicious. No publicly available SSL certificate details, HTTP response codes, or page title information have been disclosed, so the current web service characteristics remain unverified. The combination of recent creation, use of a reputable registrar, rapid deployment to a cloud‑based IP, and multiple vendor detections aligns with typical patterns observed in newly‑launched phishing infrastructure.

Defenders should block or quarantine traffic to 104.21.96.1 when associated with confirmation-id1785.com, update intrusion‑detection signatures with the observed domain and IP, and monitor for any future resolution changes. Continuous re‑scanning on VirusTotal and inclusion of the domain in internal blocklists are recommended. Because the site’s content and HTTPS configuration have not been publicly captured, analysts should treat any future observations with heightened scrutiny.