sandbox[.]allegromicro[.]cloud

Analysis of sandbox.allegromicro.cloud indicates a confirmed phishing domain targeting Allegro MicroSystems, active as of July 23, 2026. The domain was registered on March 20, 2025, through GoDaddy.com, LLC, and resolves to IP 34.96.88.200 (AS396982, Google LLC, US). Infrastructure analysis reveals the use of Google Cloud, Google Cloud CDN, and Caddy web server technology, alongside HTTP/3 support. The SSL certificate is issued by Google Trust Services (WR3), a common choice for both legitimate and malicious domains hosted on Google infrastructure. The page title, 'Allegro MicroSystems Cloud,' directly references the targeted brand, suggesting an intent to deceive users into believing the site is an official Allegro MicroSystems platform.

The domain is currently active, returning an HTTP 200 status, and has been flagged by one security blocklist. PhishDestroy has blocked the domain, and 14 of 95 security vendors on VirusTotal detect it as malicious. Gridinsoft assigns a trust score of 0/100, further indicating high risk. Nameservers (ns-cloud-b1.googledomains.com, ns-cloud-b2.googledomains.com, ns-cloud-b3.googledomains.com) align with Google Cloud DNS, a pattern observed in both legitimate and fraudulent deployments. The domain's creation date, over a year prior to this report, may suggest either a dormant campaign or strategic registration to evade immediate detection.

No evidence of a known phishing kit or specific scam subtype (e.g., credential harvesting, payment fraud) is present in the available data. Defenders should treat this domain as high-risk and prioritize blocking at the network and endpoint levels. Given the use of Google Cloud infrastructure, monitoring for additional malicious domains within the same ASN (396982) may uncover related threats. The domain's continued activity and low detection rate on some platforms warrant further investigation into its payload and distribution methods.