secure-index-page--adapediatricspa[.]replit[.]app

This domain, secure-index-page--adapediatricspa.replit.app, is actively flagged as a high-risk credential phishing site targeting users through a fake login portal. Infrastructure analysis reveals the domain is hosted on Replit Inc. infrastructure and resolves to the IP address 34.117.33.233. As of July 28, 2026, the domain remains operational and has not been assigned nameservers, which is atypical for legitimate services but consistent with ephemeral phishing deployments. Detection data from VirusTotal indicates that 15 of 91 security vendors have classified this domain as malicious, reflecting moderate consensus across detection engines.

The domain is currently listed on two security blocklists: PhishDestroy and OpenPhish, further corroborating its classification as a phishing threat. The exact brand or service being impersonated is not explicitly identified in available metadata, though the domain name suggests an attempt to mimic a pediatric or healthcare-related login page. No specific phishing kit or campaign identifiers have been linked to this domain in public threat feeds. Defenders should prioritize blocking this domain at the DNS and web proxy levels, as well as monitoring for connections to the associated IP address 34.117.33.233.

Given its active status and detection by multiple security vendors, this domain poses a credible risk for credential theft. Additional analysis of HTTP headers, SSL certificates, or page content may provide further context, but such data is not currently available in public threat intelligence sources. Organizations are advised to review logs for any user interactions with this domain and implement phishing awareness training to mitigate potential exposure.