Resolves to 172.67.179.155, 104.21.31.193.
- NXDOMAIN
- false
- A records
- 172.67.179.155, 104.21.31.193
Verdict
SUSPICIOUSMedium confidence
3Supporting signals
3Independent sources
0Recent observations
44 / 100Threat score
Why the engine decided this
Deterministic engine · activity moderate- REREGISTERED_EXPIRED_DOMAIN The domain has web history from before its current registration: it lapsed and was re-registered by a new owner.
- RANDOM_SUBDOMAIN The subdomain label looks randomly generated, typical of per-campaign phishing links.
- RECENTLY_REGISTERED Registered domain is 31-90 days old.
Key indicators
- Domain
- puygkopx.ift19.com
- Resolves to
- 172.67.179.155, 104.21.31.193
- Registered
- 2026-08-20
- Domain age
- 40 days
- Tranco rank
- Not ranked
- First seen
- Not reported by any source
- Last seen
- 2026-09-29 (0 days before)
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| Internet Archive (parent domain) | The Internet Archive has ift19.com from 2025-04-15, before its current registration: the domain lapsed and a new owner re-registered it, a common way to borrow a clean reputation. | — | — | Suspicious |
 RDAP (parent domain) | ift19.com was registered recently, on 2026-08-20. | — | — | Suspicious |
| Name analysis | The subdomain 'puygkopx' looks randomly generated, typical of per-campaign or per-victim phishing links. | — | — | Suspicious |
 VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| DNS | Resolves to 172.67.179.155, 104.21.31.193. | — | 0 days recent | Context |
Coverage · checked, no record: ThreatFox, URLhaus, OpenPhish, Tranco (parent domain) · failed: AlienVault OTX
Analyst summary
Consistent with engineSuspicious (medium confidence): ift19.com had an earlier life on the web, lapsed, and was re-registered by a new owner on 2026-08-20, a common setup for phishing. The subdomain 'puygkopx' also looks randomly generated.
Why the evidence points to suspicious
- [Internet Archive (parent domain)] The Internet Archive has ift19.com from 2025-04-15, before its current registration: the domain lapsed and a new owner re-registered it, a common way to borrow a clean reputation.
- [RDAP (parent domain)] ift19.com was registered recently, on 2026-08-20.
- [Name analysis] The subdomain 'puygkopx' looks randomly generated, typical of per-campaign or per-victim phishing links.
Lookups failed for OTX: no information either way. No reputation source has reported it yet; the verdict rests on signs of fresh or taken-over infrastructure, not on observed malicious content.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
All evidence
10 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| Internet Archive (parent domain) | The Internet Archive has ift19.com from 2025-04-15, before its current registration: the domain lapsed and a new owner re-registered it, a common way to borrow a clean reputation. | — | — | Suspicious |
| RDAP (parent domain) | ift19.com was registered recently, on 2026-08-20. | — | — | Suspicious |
| Name analysis | The subdomain 'puygkopx' looks randomly generated, typical of per-campaign or per-victim phishing links. | — | — | Suspicious |
| VirusTotal | No vendor flags it (0 of 91). | 0/91 | 0 days recent | Benign |
| DNS | Resolves to 172.67.179.155, 104.21.31.193. | — | 0 days recent | Context |
 AlienVault OTX | Lookup failed: no information either way. | — | — | Failed |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| OpenPhish | No record. | — | — | No record |
| Tranco (parent domain) | No record. | — | — | No record |
Engine rules applied
- LOOKUPS_FAILEDOne or more lookups failed; their absence carries no information.
- REREGISTERED_EXPIRED_DOMAINThe domain has web history from before its current registration: it lapsed and was re-registered by a new owner.
- RANDOM_SUBDOMAINThe subdomain label looks randomly generated, typical of per-campaign phishing links.
- RECENTLY_REGISTEREDRegistered domain is 31-90 days old.
- SINGLE_SOURCE_ONLYOnly one source family provides malicious evidence.
Analyst summary
Consistent with engineSuspicious (medium confidence): ift19.com had an earlier life on the web, lapsed, and was re-registered by a new owner on 2026-08-20, a common setup for phishing. The subdomain 'puygkopx' also looks randomly generated.
Why the evidence points to suspicious
- [Internet Archive (parent domain)] The Internet Archive has ift19.com from 2025-04-15, before its current registration: the domain lapsed and a new owner re-registered it, a common way to borrow a clean reputation.
- [RDAP (parent domain)] ift19.com was registered recently, on 2026-08-20.
- [Name analysis] The subdomain 'puygkopx' looks randomly generated, typical of per-campaign or per-victim phishing links.
Key indicators
- Domain
- puygkopx.ift19.com
- Resolves to
- 172.67.179.155, 104.21.31.193
- Registered
- 2026-08-20
- Domain age
- 40 days
- Tranco rank
- Not ranked
- First seen
- Not reported by any source
- Last seen
- 2026-09-29 (0 days before)
Related indicators
- 172.67.179.155Resolved address
- 104.21.31.193Resolved address
By source
RDAP (parent domain)ift19.com was registered recently, on 2026-08-20.
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-29DNS: Resolves to 172.67.179.155, 104.21.31.193
- 2026-09-29VirusTotal: No vendor flags it (0 of 91)
- 2026-09-29Investigated
Run history
2 collections of this indicator- 2026-09-29SUSPICIOUS44Live lookupsShown
- 2026-09-29UNKNOWN25Live lookupsOpen
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- blockBlock puygkopx.ift19.com at the proxy or DNS layer.
- enrichDetonate the link in an interactive sandbox with a real browser; phishing gates often show a decoy page to scanners from data centres.
- huntSearch proxy, DNS and email logs for puygkopx.ift19.com.
- pivotCertificate transparency and passive DNS for domains related to ift19.com.
Pivot to other tools
Opens the indicator in the source's own site (new tab).