luminex[.]app

Analysis indicates that the domain luminex.app is currently active and serves a generic phishing page titled LUMINEX. The site resolves to IP address 199.36.158.100, which belongs to ASN 54113 operated by Fastly, Inc. in the United States. DNS is delegated to ns07.domaincontrol.com and ns08.domaincontrol.com. HTTP responses return a 200 status code, and the site presents a valid TLS certificate issued by Google Trust Services under the WR3 identifier, with HSTS enforcement and HTTP/3 support. Infrastructure scans reveal the use of Firebase as a backend service. Reputation data shows that five of ninety‑five VirusTotal scanners have flagged the domain, Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. It is already blocked by the PhishDestroy service. The exact content of the page has not been publicly disclosed, so the specific credential collection mechanisms remain uncertain. Defenders should block both the domain and its resolved IP address at perimeter and DNS layers, ensure TLS inspection to detect any hidden payloads, and monitor for related activity targeting the same infrastructure. Continuous threat‑intel feeds should be consulted for updates, and any observed attempts to exfiltrate credentials from this host should be logged and investigated promptly.