# PhishDestroy domain threat record: ceditoubiidisponible--cred-ubiii.replit.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/ceditoubiidisponible--cred-ubiii.replit.app/ Machine-readable companion: https://phishdestroy.io/domain/ceditoubiidisponible--cred-ubiii.replit.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 03:12:12 UTC - Last availability or vendor check: 2026-10-23 22:08:47 UTC - Stored record updated: 2026-10-23 22:21:00 UTC - VirusTotal detections in the stored snapshot: 5/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 34.117.33.233 - Registrar in stored WHOIS data: Nom-IQ Limited dba Com Laude - Last stored HTTP status: 301 - Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/ceditoubiidisponible--cred-ubiii.replit.app - Certificate Transparency search: https://crt.sh/?q=%25.ceditoubiidisponible--cred-ubiii.replit.app - Web Archive lookup: https://web.archive.org/web/*/https://ceditoubiidisponible--cred-ubiii.replit.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview ceditoubiidisponible--cred-ubiii.replit.app is an impersonation phishing page running as a user-created app on Replit's hosting platform. Its Spanish-flavoured hostname, built around 'credito disponible' (available credit) and 'cred', points to a lure aimed at people who expect a credit or account balance they can claim. PhishDestroy first flagged it on 2026-09-17. As of 2026-10-19 the address was still alive and answering with a redirect. How the scam works Impersonation pages copy the look and wording of a service the victim already trusts, then ask the victim to log in, verify an account or confirm details to unlock the promised funds. Whatever is typed in goes straight to the operator, who can use it to take over the real account or move money. The page currently shows the title 'This app isn't live yet', Replit's placeholder for an unpublished app, which differs from the impersonation content we classified. Because the address now redirects, the lure can be switched back on or pointed elsewhere at any moment. Evidence Five of 89 VirusTotal engines flag the address as of 2026-09-23: ChainPatrol, alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and LevelBlue. That is a modest count, but the mix of a crypto-focused scanner with general web-security vendors is meaningful. The address also appears on the MetaMask and SEAL blocklists alongside PhishDestroy. MetaMask and SEAL both maintain crypto-oriented lists, so wallet users get a warning from those sources. Infrastructure The registration date of 2021-04-16 and the registrar, Nom-IQ Limited dba Com Laude, belong to Replit's shared replit.app domain, not to this operator. The scammer only had to create a free app subdomain, which leaves no registration trail of their own. Traffic is served from Google LLC infrastructure in the US, the network behind Replit's hosting. What to do If you entered a username, password or one-time code on this page, change that password immediately on the genuine service and anywhere you reused it. Then enable app-based two-factor authentication and review recent logins and transactions. If you shared card or bank details, contact your bank to block the card and dispute unfamiliar charges. Treat any follow-up message promising to release your 'available credit' as part of the same scam. Defenders should block the full hostname rather than all of replit.app, report the app to Replit for removal, and watch for sibling subdomains using the same credit-themed wording. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/ceditoubiidisponible--cred-ubiii.replit.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ceditoubiidisponible--cred-ubiii.replit.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:57:59 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b9fc6f92-f038-4535-8376-eb6888dab8ba.png Captured: 2026-09-23 08:42:39 UTC Source report: https://radar.cloudflare.com/scan/b9fc6f92-f038-4535-8376-eb6888dab8ba SHA-256: a5ac8eda517ee37d65362de04b34d7edcf44e77812a3438153e2c14b97e0e85d - URLScan ยท 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ad61-084f-715a-a4aa-4242d86c336e.png Captured: 2026-09-17 03:20:20 UTC Source report: https://urlscan.io/result/01a0ad61-084f-715a-a4aa-4242d86c336e/ SHA-256: 5fa698485cff098b2786c203b0c7c56d76caf853283d083216ddc8666043d202 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:40Z", "uuid": "b9fc6f92-f038-4535-8376-eb6888dab8ba", "scanned_at": "2026-09-23T08:42:39Z", "final_url": "https://ceditoubiidisponible--cred-ubiii.replit.app/", "status": 404, "history": [ { "url": "https://ceditoubiidisponible--cred-ubiii.replit.app/", "status": 404 } ], "dom_hash": "bebe73542fb033badbed0a2bc2f53b7deaa7a02e93da346597768b0124b34ee7", "doc_hash": "13f006dcbc81382b0c7e643fd5463be6bd2e6355da7bc5eca98e316000a80290", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ceditoubiidisponible--cred-ubiii.replit.app", "type": "A", "value": "34.117.33.233" } ], "dnssec_valid": false, "ip": "34.117.33.233", "whois": { "registrar": "Nom-IQ Limited dba Com Laude", "created": "2021-04-16T20:44:58Z", "updated": "2025-10-10T03:54:10Z", "expires": "2034-04-16T20:44:58Z", "nameservers": [ "ns-cloud-b1.googledomains.com", "ns-cloud-b2.googledomains.com", "ns-cloud-b3.googledomains.com", "ns-cloud-b4.googledomains.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:27:58Z", "analysis_at": "2026-09-16T11:03:41Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 5, "suspicious": 0, "undetected": 37 }, "detections": { "CRDF": "malicious", "LevelBlue": "phishing", "ChainPatrol": "malicious", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Information Technology, Malicious (alphaMountain.ai)" }, "created": "2021-04-16T00:00:00Z", "updated": "2025-12-04T00:00:00Z", "first_seen": "2026-09-16T11:25:43Z", "dns": [ { "ttl": 3600, "type": "A", "value": "34.117.33.233" } ], "dns_at": "2026-09-16T11:25:45Z", "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84", "cert": { "san": [ "replit.app", "*.replit.app" ], "issuer": "Google Trust Services / WR3", "serial": "b3df8d4daf091430a5fcdb9944aa352", "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae", "subject": "replit.app", "valid_to": "2026-12-01T12:25:50Z", "valid_from": "2026-09-02T11:30:15Z" }, "whois": [] } } ```