secure-page-builder--daklmk[.]replit[.]app

The domain secure-page-builder--daklmk.replit.app is flagged as an active credential‑phishing site as of July 21, 2026. Infrastructure analysis shows the domain resolves to the IPv4 address 34.117.33.233, which belongs to the Replit Inc. hosting platform. Registration records indicate the domain was created through Replit Inc., confirming that the attacker is leveraging a legitimate development service to host the malicious payload. The domain appears on one external security blocklist and has been specifically blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. VirusTotal scans report that 13 of 95 security vendors have flagged the domain, providing independent corroboration of its phishing nature. DNS queries return NS_NOT_FOUND, meaning no authoritative name‑server information is available; this limits the ability to trace the underlying DNS configuration but does not diminish the risk. Current evidence does not include SSL/TLS details, HTTP response codes, page titles, or brand targeting, so the exact content of the hosted page remains unverified. Defenders should treat any traffic to or from this domain and its IP address as hostile. Immediate mitigation steps include adding the domain and the associated IP address to network‑level blocklists, updating intrusion‑detection signatures to flag outbound connections to 34.117.33.233, and monitoring DNS logs for any resolution attempts. Organizations using Replit for development should review usage policies and consider reporting the abuse to Replit’s abuse team to expedite takedown. Continuous monitoring of threat‑intel feeds for additional indicators related to this domain is recommended, as further analysis may reveal the specific credential‑harvesting tactics employed.