Resolves to 104.21.31.193, 172.67.179.155.
- NXDOMAIN
- false
- A records
- 104.21.31.193, 172.67.179.155
Verdict
UNKNOWNLow confidence
No source reports this indicator as malicious. That does not prove it is safe: it may simply be new.
0Supporting signals
0Independent sources
0Recent observations
25 / 100Threat score
Why the engine decided this
Deterministic engine · activity none- No rule raised or lowered concern; the evidence is insufficient.
Key indicators
- Domain
- puygkopx.ift19.com
- Resolves to
- 104.21.31.193, 172.67.179.155
- Registered
- 2026-08-20
- Domain age
- 40 days
- Tranco rank
- Not ranked
- First seen
- Not reported by any source
- Last seen
- —
Relationship graph
Expand| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| DNS | Resolves to 104.21.31.193, 172.67.179.155. | — | 1 day recent | Context |
 RDAP (parent domain) | ift19.com registered 2026-08-20. | — | — | Context |
Coverage · checked, no record: ThreatFox, URLhaus, OpenPhish, AlienVault OTX, VirusTotal, Tranco (parent domain) · failed: none
Analyst summary
Consistent with engineUnknown: nothing links this indicator to malicious or benign activity.
Nothing was found, which is a coverage gap rather than evidence of safety.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Threat context
Context onlyNo group is directly linked to this indicator by any source.
All evidence
8 sources queried · click a row for its raw fields · ages computed by the engine| Source | Finding | Confidence | Age | Signal |
|---|---|---|---|---|
| DNS | Resolves to 104.21.31.193, 172.67.179.155. | — | 1 day recent | Context |
| RDAP (parent domain) | ift19.com registered 2026-08-20. | — | — | Context |
 ThreatFox | No record. | — | — | No record |
| URLhaus | No record. | — | — | No record |
| OpenPhish | No record. | — | — | No record |
 AlienVault OTX | No record. | — | — | No record |
 VirusTotal | No record. | — | — | No record |
| Tranco (parent domain) | No record. | — | — | No record |
Engine rules applied
- NO_POSITIVE_EVIDENCENo source provides malicious or benign evidence; absence is not proof either way.
Analyst summary
Consistent with engineUnknown: nothing links this indicator to malicious or benign activity.
Nothing was found, which is a coverage gap rather than evidence of safety.
Attribution
The evidence does not establish who operates this indicator.
Written by rules from the engine's evidenceSuggested pivots
Key indicators
- Domain
- puygkopx.ift19.com
- Resolves to
- 104.21.31.193, 172.67.179.155
- Registered
- 2026-08-20
- Domain age
- 40 days
- Tranco rank
- Not ranked
- First seen
- Not reported by any source
- Last seen
- —
Related indicators
- 104.21.31.193Resolved address
- 172.67.179.155Resolved address
By source
RDAP (parent domain)ift19.com registered 2026-08-20.
- Domain
Relationship graph
Click a node for details · edges are observed relationships, not ownershipContext
Attribution
The evidence does not establish who operates this indicator.
Relationship ≠ ownership. Shared IPs, ASNs or platforms never imply the same operator.
Threat context
Context onlyNo group is directly linked to this indicator by any source.
Evidence timeline
- 2026-09-28DNS: Resolves to 104.21.31.193, 172.67.179.155
- 2026-09-29Investigated
Run history
2 collections of this indicator- 2026-09-29SUSPICIOUS44Live lookupsOpen · newest
- 2026-09-29UNKNOWN25Live lookupsShown
Sources are checked again on every live run, so a source that has since dropped the indicator from its feed can change the verdict. Each run keeps the evidence exactly as it was collected.
Recommended next steps
- enrichScan puygkopx.ift19.com in a sandboxed browser or urlscan to see what it serves.
- huntSearch DNS and proxy logs for puygkopx.ift19.com.
Pivot to other tools
Opens the indicator in the source's own site (new tab).