# PhishDestroy domain threat record: finanzcuador--ecayuda.replit.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/finanzcuador--ecayuda.replit.app/
Machine-readable companion: https://phishdestroy.io/domain/finanzcuador--ecayuda.replit.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-01 16:54:15 UTC
- Last availability or vendor check: 2026-10-23 22:08:22 UTC
- Stored record updated: 2026-10-23 23:55:23 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 34.117.33.233
- Registrar in stored WHOIS data: Nom-IQ Limited dba Com Laude
- Last stored HTTP status: 301
- Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a05fc0-1ee9-73b8-8957-5aa47777c569/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/finanzcuador--ecayuda.replit.app
- Certificate Transparency search: https://crt.sh/?q=%25.finanzcuador--ecayuda.replit.app
- Web Archive lookup: https://web.archive.org/web/*/https://finanzcuador--ecayuda.replit.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
finanzcuador--ecayuda.replit.app is an impersonation phishing page hosted as an app on Replit. Its hostname blends "finanz", "cuador" and "ayuda", which points to Spanish-speaking users in Ecuador who are looking for financial help or support. PhishDestroy first flagged it on 2026-09-01. As of 2026-10-19 the site was still up, and its content answered with a redirect.

How the scam works
Impersonation pages like this copy the look and wording of a trusted financial or assistance service. Visitors are then asked for login credentials, identity details, card data or an upfront "processing fee" to unlock promised aid. Everything entered goes straight to the operators, who can use it for account takeover, fraud or resale. When we last checked, the page title read "This app isn't live yet", the standard Replit placeholder. That title does not match our impersonation classification, and the visible content may differ from what victims were shown.

Evidence
On 2026-09-15, 17 of 89 VirusTotal engines flagged the address. They included alphaMountain.ai, BitDefender, CRDF, Ermes, ESET, Emsisoft, Fortinet and G-Data, a spread of independent vendors that agree on the verdict. Google Safe Browsing lists it under SOCIAL_ENGINEERING, the category for deceptive pages that trick people into giving up information. Of the blocklists we track, only PhishDestroy currently includes it.

Infrastructure
The 2021-04-16 registration date and the registrar Nom-IQ Limited dba Com Laude belong to replit.app, the shared parent domain. They say nothing about when the scammer set up this subdomain. The page runs on Google LLC infrastructure in the US (34.117.33.233), the standard path for Replit-hosted apps. Its certificate from Google Trust Services (WR3) is the one Replit issues automatically. Free app hosting lets operators launch a convincing lure in minutes under a reputable parent domain.

What to do
If you entered a password on this page, change it right away on the real service and on any account that reuses it, and turn on two-factor authentication. If you shared card or bank details, call your bank to block the card and dispute any charges. Never pay a "fee" to receive aid or a loan, and treat identity documents you uploaded as compromised. Defenders should block the full subdomain, watch for sibling replit.app hostnames with similar Ecuadorian finance wording, and report the app to Replit for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a05fc0-1ee9-73b8-8957-5aa47777c569/
VirusTotal report: https://www.virustotal.com/gui/domain/finanzcuador--ecayuda.replit.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=finanzcuador--ecayuda.replit.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:52:26 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a05fc0-1ee9-73b8-8957-5aa47777c569.png
  Captured: 2026-09-01 16:54:15 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a05fc0-1ee9-73b8-8957-5aa47777c569.png
  Captured: 2026-09-22 03:32:49 UTC
  Source report: https://urlscan.io/result/01a05fc0-1ee9-73b8-8957-5aa47777c569/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/afa70842-d97d-493b-a290-e735c3327c0b.png
  Captured: 2026-09-13 05:01:37 UTC
  Source report: https://radar.cloudflare.com/scan/afa70842-d97d-493b-a290-e735c3327c0b
  SHA-256: de4570eaf70a0ca4fa6ba0a0636b123c82cfa53974207cb5a94da74b8d34a8e9
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a0593e-e2cb-731e-a158-7afcfcc75470.png
  Captured: 2026-08-31 19:14:55 UTC
  Source report: https://urlscan.io/result/01a0593e-e2cb-731e-a158-7afcfcc75470/
  SHA-256: 7cdd20babb1ac487a1dc33436639be751242242160a2e08669e6afd9de16275f
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05a7c-cd04-74be-a2ee-1eeba671ae1d.png
  Captured: 2026-09-01 01:02:10 UTC
  Source report: https://urlscan.io/result/01a05a7c-cd04-74be-a2ee-1eeba671ae1d/
  SHA-256: 403206ed0e9f36b139b05304130992d6d6aacd6fa0b1b7028adf6a6e3b434ef0
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05b2b-8e5e-759b-9343-b8b8fadfcb2c.png
  Captured: 2026-09-01 04:13:04 UTC
  Source report: https://urlscan.io/result/01a05b2b-8e5e-759b-9343-b8b8fadfcb2c/
  SHA-256: 7cdd20babb1ac487a1dc33436639be751242242160a2e08669e6afd9de16275f
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05b48-bbc5-77f3-8234-debe13807fc9.png
  Captured: 2026-09-01 04:44:56 UTC
  Source report: https://urlscan.io/result/01a05b48-bbc5-77f3-8234-debe13807fc9/
  SHA-256: 51da1764c0ae54415452dbae5e33580f133e5dfe36c131f480913aed9ab7e0c3
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05de8-e1d6-73bd-9205-8e7631a04f94.png
  Captured: 2026-09-01 16:59:04 UTC
  Source report: https://urlscan.io/result/01a05de8-e1d6-73bd-9205-8e7631a04f94/
  SHA-256: 8a38048ff35027382671fe7911dd42eb85b20979cbe415fa93f740bba3a06a8c
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d2cd-3dfe-769e-8504-0f1cfa5749e6.png
  Captured: 2026-09-24 09:44:26 UTC
  Source report: https://urlscan.io/result/01a0d2cd-3dfe-769e-8504-0f1cfa5749e6/
  SHA-256: e75825bb50c40bf08f9c5f19c02708d7c67158eb17988ae7a99983e4637a2212

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:17:27Z",
        "uuid": "01a05fc0-1ee9-73b8-8957-5aa47777c569",
        "scanned_at": "2026-09-02T01:33:47Z",
        "final_url": "https://finanzcuador--ecayuda.replit.app/index2.html",
        "status": 404,
        "ip": "34.117.33.233",
        "ptr": "233.33.117.34.bc.googleusercontent.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "192.178.183.94",
            "2a00:1450:4001:c13::5f",
            "34.117.33.233"
        ],
        "asns": [
            "15169",
            "396982"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "docs.replit.com",
            "replit.com"
        ],
        "doc_hash": "171a60dd37ccb5d46e6a8bece68684ecc1e1502a632a6ef9883c367fb44877db",
        "globals": [
            "reload_timeout"
        ],
        "tls": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR3",
            "subject": "replit.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-07T11:08:41Z",
            "valid_from": "2026-07-09T10:12:48Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1384,
        "tls_age_days": 54,
        "tls_valid_days": 90,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 85,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:27:29Z",
        "uuid": "afa70842-d97d-493b-a290-e735c3327c0b",
        "scanned_at": "2026-09-13T05:01:37Z",
        "final_url": "https://finanzcuador--ecayuda.replit.app/",
        "status": 404,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://finanzcuador--ecayuda.replit.app/",
                "status": 307
            },
            {
                "url": "https://finanzcuador--ecayuda.replit.app/",
                "status": 404
            }
        ],
        "dom_hash": "56ff95bd24b5e042d0ffbbb6fb629df7a4e4f2e37588963dc702708d85b7d8b1",
        "doc_hash": "171a60dd37ccb5d46e6a8bece68684ecc1e1502a632a6ef9883c367fb44877db",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "finanzcuador--ecayuda.replit.app",
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dnssec_valid": false,
        "ip": "34.117.33.233",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Nom-IQ Limited dba Com Laude",
            "created": "2021-04-16T20:44:58Z",
            "updated": "2025-10-10T03:54:10Z",
            "expires": "2034-04-16T20:44:58Z",
            "nameservers": [
                "ns-cloud-b1.googledomains.com",
                "ns-cloud-b2.googledomains.com",
                "ns-cloud-b3.googledomains.com",
                "ns-cloud-b4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:28:43Z",
        "analysis_at": "2026-10-22T01:49:23Z",
        "stats": {
            "timeout": 0,
            "harmless": 41,
            "malicious": 19,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "Ermes": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "URLQuery": "malicious",
            "LevelBlue": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2021-04-16T00:00:00Z",
        "updated": "2025-12-04T00:00:00Z",
        "first_seen": "2026-08-31T19:53:18Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dns_at": "2026-10-22T01:54:45Z",
        "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84",
        "cert": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "issuer": "Google Trust Services / WR3",
            "serial": "b3df8d4daf091430a5fcdb9944aa352",
            "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae",
            "subject": "replit.app",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "whois": []
    }
}
```