secure-page-builder--stevedentltds[.]replit[.]app

This domain secure-page-builder--stevedentltds.replit.app is assessed as a high-risk credential phishing threat and remains active as of July 30, 2026. The domain is registered through Replit Inc. and resolves to IP address 34.117.33.233. VirusTotal analysis shows 7 out of 91 security vendors flagging this domain as malicious, providing strong corroborating evidence of its hostile nature. The domain appears on one security blocklist and is currently blocked by PhishDestroy.

Nameserver records are not found, which is atypical for legitimate services and may indicate either a recent configuration or an attempt to evade detection. No Safe Browsing, OTX, SSL certificate, HTTP status code, trust score, or page title data is available in the intelligence provided, so the exact visual content and brand impersonation target of the phishing page are not yet analysed. The absence of nameservers and the use of a subdomain under replit.app suggests the attacker is leveraging a free hosting platform to host the phishing infrastructure.

Defenders should treat this domain as confirmed malicious, block all traffic to secure-page-builder--stevedentltds.replit.app and its IP 34.117.33.233 at the network perimeter, and monitor for any users who may have visited the site. Credentials entered on this domain should be considered compromised and reset immediately. Continued monitoring is recommended as the domain remains active and may evolve its attack surface.