security-hub--halebowdondenta[.]replit[.]app

This domain, security-hub--halebowdondenta.replit.app, is identified as a credential harvesting phishing site designed to deceive users into submitting account credentials. The page title, 'Sign in to your account,' suggests an attempt to impersonate legitimate authentication portals, likely targeting users of cloud services, email providers, or enterprise platforms. Infrastructure analysis reveals the domain is hosted on a Google Cloud IP (34.117.33.233) under AS396982, a common tactic to exploit reputable hosting providers for phishing campaigns. Evidence confirms the domain's malicious nature through multiple technical indicators. Security vendors on VirusTotal flagged the domain in 23 out of 95 engines, indicating broad detection consensus. The domain appears on one security blocklist and was proactively blocked by enterprise-grade filtering systems. It was registered through Nom-IQ Limited dba Com Laude, though no creation date is available in the provided data. The SSL certificate, issued by Google Trust Services (WR3), further aligns with the use of legitimate-looking encryption to evade user suspicion. Users who visited this domain or entered credentials should immediately revoke access to any submitted accounts, particularly if reused passwords are involved. Reset passwords using a secure device and enable multi-factor authentication where available. Monitor linked accounts for unauthorized activity, as harvested credentials may be exploited in follow-on attacks. Organizations should update internal blocklists to include this domain and its resolving IP (34.117.33.233) to prevent future exposure. The domain is currently offline, but threat actors may redeploy similar infrastructure under new subdomains or IPs.