# PhishDestroy domain threat record: oiuytfghjkdfgvbn--crediecuador1.replit.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/oiuytfghjkdfgvbn--crediecuador1.replit.app/
Machine-readable companion: https://phishdestroy.io/domain/oiuytfghjkdfgvbn--crediecuador1.replit.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-06 12:36:38 UTC
- Last availability or vendor check: 2026-10-23 22:08:29 UTC
- Stored record updated: 2026-10-23 22:22:15 UTC
- VirusTotal detections in the stored snapshot: 22/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 34.117.33.233
- Registrar in stored WHOIS data: Nom-IQ Limited dba Com Laude
- Last stored HTTP status: 301
- Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09b00-8f22-7397-9e7b-81cb985ab430/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/oiuytfghjkdfgvbn--crediecuador1.replit.app
- Certificate Transparency search: https://crt.sh/?q=%25.oiuytfghjkdfgvbn--crediecuador1.replit.app
- Web Archive lookup: https://web.archive.org/web/*/https://oiuytfghjkdfgvbn--crediecuador1.replit.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This Replit-hosted app uses "crediecuador1" in its hostname, behind a random-looking keyboard string. It is built to pass as a credit or lending service tied to the CrediEcuador name and is aimed at people in Ecuador looking for loans or credit checks. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-09-06. As of 2026-10-19 the site was still alive and answering with a redirect.

How the scam works
Lending-brand impersonation usually promises fast approval or a free credit check. The victim is then asked for ID numbers, contact details, bank logins or card data, and sometimes a small upfront "processing" or "insurance" fee before the loan is released. The money never arrives, and the personal and banking data can be reused for account takeover or fraud. The page title currently reads "This app isn't live yet", Replit's placeholder text, while our classification is impersonation phishing.

Evidence
Google Safe Browsing flags the address for SOCIAL_ENGINEERING, which means visitors on most major browsers get a deceptive-site warning. On VirusTotal, 22 of 89 engines marked it malicious as of 2026-09-17. That is broad agreement for a single app subdomain, with alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Ermes, ESET and Emsisoft among them. The address is also on the PhishDestroy blocklist.

Infrastructure
The 2021-04-16 registration date and the registrar Nom-IQ Limited dba Com Laude belong to the parent replit.app platform domain, not to the scammer. The operator only had to spin up a free subdomain, which costs nothing and can be replaced in minutes. Traffic is served from Google LLC infrastructure in the US, and the Google Trust Services certificate comes with the platform. The padlock therefore says nothing about who runs the page.

What to do
If you entered a national ID, phone number or address, watch for follow-up calls or messages offering "loan release" and ignore them. If you typed in online-banking credentials, change the password, turn on two-factor authentication and ask your bank to monitor or block the account. If you paid any fee or shared card details, contact your bank to dispute the charge and cancel the card, and do not send further payments however the request is framed. Defenders should block the hostname and report it to Replit for removal. They should also watch for sibling subdomains that reuse the "crediecuador" string.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09b00-8f22-7397-9e7b-81cb985ab430/
VirusTotal report: https://www.virustotal.com/gui/domain/oiuytfghjkdfgvbn--crediecuador1.replit.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=oiuytfghjkdfgvbn--crediecuador1.replit.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:58:37 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09b00-8f22-7397-9e7b-81cb985ab430.png
  Captured: 2026-09-06 12:36:38 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a09b00-8f22-7397-9e7b-81cb985ab430.png
  Captured: 2026-09-22 03:32:46 UTC
  Source report: https://urlscan.io/result/01a09b00-8f22-7397-9e7b-81cb985ab430/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d8d2ddc4-d6f6-4752-ac83-b0bb8214393c.png
  Captured: 2026-09-15 08:49:42 UTC
  Source report: https://radar.cloudflare.com/scan/d8d2ddc4-d6f6-4752-ac83-b0bb8214393c
  SHA-256: de4570eaf70a0ca4fa6ba0a0636b123c82cfa53974207cb5a94da74b8d34a8e9
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a073ca-506c-73c8-9275-9df51e17ac99.png
  Captured: 2026-09-05 22:57:22 UTC
  Source report: https://urlscan.io/result/01a073ca-506c-73c8-9275-9df51e17ac99/
  SHA-256: 51da1764c0ae54415452dbae5e33580f133e5dfe36c131f480913aed9ab7e0c3
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a073f6-9ab0-75c3-a9e5-2dc4679cb572.png
  Captured: 2026-09-05 23:45:44 UTC
  Source report: https://urlscan.io/result/01a073f6-9ab0-75c3-a9e5-2dc4679cb572/
  SHA-256: 89ba8f2fd70f85655e484187be18f69bc1e32fb728c47438ab40ecfb8ad3f65b
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a0743d-ee3a-707f-be88-82b7b47e3b6b.png
  Captured: 2026-09-06 01:03:37 UTC
  Source report: https://urlscan.io/result/01a0743d-ee3a-707f-be88-82b7b47e3b6b/
  SHA-256: 8a38048ff35027382671fe7911dd42eb85b20979cbe415fa93f740bba3a06a8c
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a076b8-a112-755b-aa97-05f585524be2.png
  Captured: 2026-09-06 12:36:56 UTC
  Source report: https://urlscan.io/result/01a076b8-a112-755b-aa97-05f585524be2/
  SHA-256: 8a38048ff35027382671fe7911dd42eb85b20979cbe415fa93f740bba3a06a8c
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a076bc-54ea-71a9-b94e-1d7e85b1ee65.png
  Captured: 2026-09-06 12:40:55 UTC
  Source report: https://urlscan.io/result/01a076bc-54ea-71a9-b94e-1d7e85b1ee65/
  SHA-256: 8a38048ff35027382671fe7911dd42eb85b20979cbe415fa93f740bba3a06a8c
- URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a08707-1c02-7668-83cb-e34dd660fd02.png
  Captured: 2026-09-09 16:36:31 UTC
  Source report: https://urlscan.io/result/01a08707-1c02-7668-83cb-e34dd660fd02/
  SHA-256: 8a38048ff35027382671fe7911dd42eb85b20979cbe415fa93f740bba3a06a8c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:13:26Z",
        "uuid": "01a09b00-8f22-7397-9e7b-81cb985ab430",
        "scanned_at": "2026-09-13T13:41:46Z",
        "final_url": "https://oiuytfghjkdfgvbn--crediecuador1.replit.app/",
        "status": 404,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://oiuytfghjkdfgvbn--crediecuador1.replit.app/",
                "from": "http://oiuytfghjkdfgvbn--crediecuador1.replit.app/",
                "status": 307
            }
        ],
        "ip": "34.117.33.233",
        "ptr": "233.33.117.34.bc.googleusercontent.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "192.178.183.94",
            "142.250.154.95",
            "34.117.33.233"
        ],
        "asns": [
            "15169",
            "396982"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "docs.replit.com",
            "replit.com"
        ],
        "doc_hash": "171a60dd37ccb5d46e6a8bece68684ecc1e1502a632a6ef9883c367fb44877db",
        "globals": [
            "reload_timeout"
        ],
        "tls": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR3",
            "subject": "replit.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "domain_age_days": 7,
        "apex_age_days": 7,
        "tls_age_days": 11,
        "tls_valid_days": 90,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 91,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:24:58Z",
        "uuid": "d8d2ddc4-d6f6-4752-ac83-b0bb8214393c",
        "scanned_at": "2026-09-15T08:49:42Z",
        "final_url": "https://oiuytfghjkdfgvbn--crediecuador1.replit.app/",
        "status": 404,
        "history": [
            {
                "url": "https://oiuytfghjkdfgvbn--crediecuador1.replit.app/",
                "status": 404
            }
        ],
        "dom_hash": "56ff95bd24b5e042d0ffbbb6fb629df7a4e4f2e37588963dc702708d85b7d8b1",
        "doc_hash": "171a60dd37ccb5d46e6a8bece68684ecc1e1502a632a6ef9883c367fb44877db",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "oiuytfghjkdfgvbn--crediecuador1.replit.app",
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dnssec_valid": false,
        "ip": "34.117.33.233",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Nom-IQ Limited dba Com Laude",
            "created": "2021-04-16T20:44:58Z",
            "updated": "2025-10-10T03:54:10Z",
            "expires": "2034-04-16T20:44:58Z",
            "nameservers": [
                "ns-cloud-b1.googledomains.com",
                "ns-cloud-b2.googledomains.com",
                "ns-cloud-b3.googledomains.com",
                "ns-cloud-b4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T10:33:21Z",
        "analysis_at": "2026-10-22T06:58:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 40,
            "malicious": 20,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "Ermes": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "URLQuery": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2021-04-16T00:00:00Z",
        "updated": "2025-12-04T00:00:00Z",
        "first_seen": "2026-09-05T23:00:09Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dns_at": "2026-10-22T07:03:23Z",
        "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84",
        "cert": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "issuer": "Google Trust Services / WR3",
            "serial": "b3df8d4daf091430a5fcdb9944aa352",
            "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae",
            "subject": "replit.app",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "whois": []
    }
}
```