attirealchemy[.]shop

attirealchemy.shop is currently active and has been classified as a high‑risk generic phishing site. The domain was registered on March 02, 2026 through Alibaba.com Singapore E‑Commerce Private Limited and immediately began serving web content over HTTPS using a Let’s Encrypt R12 certificate. HTTP requests receive a 200 response, indicating a fully functional front‑end likely used to host credential‑stealing pages. Technical probing shows the domain resolves to the single IPv4 address 34.120.55.66, which belongs to Google Cloud infrastructure located in the United States. The hosting provider’s cloud footprint aligns with the observed Gridinsoft trust score of 1 / 100, reflecting a severely low reputation. The IP appears in one security blocklist and is listed as blocked by PhishDestroy, confirming that external filtering services have already flagged the host. External threat feeds corroborate the malicious nature of the site. AlienVault OTX reports the IP in four distinct threat‑intel pulses, and VirusTotal scans show five out of ninety‑five security vendors flagging the domain as malicious. These independent detections reinforce the internal assessment and indicate that the site is being shared among multiple abuse communities. Defenders should add attirealchemy.shop and its resolved IP 34.120.55.66 to deny‑list or block policies across firewalls, web proxies, and endpoint protection tools. Monitoring for outbound connections to the Google Cloud IP range can help capture any attempted exfiltration. Organizations should also educate users about recent phishing campaigns that may reference the “attirealchemy” brand, and enforce multi‑factor authentication to mitigate credential compromise. Continuous re‑evaluation of the domain’s status is advised, as the infrastructure may shift to additional cloud instances.