simple-server-page--coleeggleston04[.]replit[.]app

Analysis as of July 24, 2026 confirms that the domain simple-server-page--coleeggleston04.replit.app remains actively used for phishing. The site is listed on two public security blocklists and has been ingested by both PhishDestroy and OpenPhish, indicating that multiple threat‑intelligence feeds have flagged it. Registration data ties the domain to Replit Inc., a legitimate hosting provider, and the domain resolves to the IPv4 address 34.117.33.233.

VirusTotal scans show that 15 of 91 antivirus engines flag the domain as malicious, reinforcing the suspicion of malicious activity. Nameserver information is unavailable, and no additional metadata such as SSL certificates or HTTP response codes have been published, leaving those aspects of the infrastructure unverified. Defenders should immediately add the domain and its resolving IP to outbound deny lists, and ensure that internal DNS filtering solutions block resolution.

Network‑level controls, such as firewall rules denying traffic to 34.117.33.233, can reduce exposure. Continuous monitoring of DNS queries for the domain and periodic re‑scans on VirusTotal are advised to capture any changes in detection rates. Because the domain is hosted on a shared platform, threat‑hunting teams should also watch for sibling subdomains that may be leveraged for similar campaigns.