alumix-pro--alumixportal[.]us-central1[.]hosted[.]app

Analysis of alumix-pro--alumixportal.us-central1.hosted.app shows a high‑risk generic phishing infrastructure that remains active as of 12 July 2026. The domain is registered through MarkMonitor Inc. and delegated to three Google Cloud nameservers (ns-cloud-b1, b2, b3.googledomains.com). DNS resolution points to 35.219.200.16, an address owned by Google LLC in South Korea, and the site serves over HTTPS using a certificate issued by Google Trust Services (WR3). The HTTP response is 200 and the page title returned is "Create Next App"; no additional page content has been captured. Technology fingerprinting reveals a stack built on Node.js, Envoy, React, Next.js, Webpack and the Google Cloud runtime, including Cloud Trace and Cloud CDN. Threat intelligence indicates that one of ninety‑five AV engines on VirusTotal flagged the domain, and it appears on a single security blocklist, with PhishDestroy already enforcing a block. The risk level is classified as high, and the domain is listed as active. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint layers, monitor outbound connections for traffic to the host, and consider adding the address to threat‑intel feeds. Continued observation is advised to detect any changes in content or additional payloads, as the current page content beyond the title has not been examined.