# PhishDestroy threat dossier — secure-page-builder--daklmk.replit.app ================================================================ Fetched: 2026-07-22 19:15:06 UTC Canonical: https://phishdestroy.io/domain/secure-page-builder--daklmk.replit.app/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 13/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, ESET, Emsisoft, Fortinet, G-Data, Kaspersky, LevelBlue, Lionic, Netcraft, Sophos, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 34.117.33.233 (US, Kansas City) ASN: ASAS396982 GOOGLE-CLOUD-PLATFORM - Google LLC, US Hosting org: AS396982 Google LLC Registrar: Replit Inc. Nameservers: NS_NOT_FOUND Page title: Docusign | #1 in Electronic Signature and Intelligent Agreement Managemen HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WR3 Expires: 2026-10-07 Status: INVALID chain Fingerprint: a12f2e822849b9ecff39647f2906061a178fa6c8299cbb261168850e42d826fd Subject Alternative Names (related infrastructure — often same operator): - replit.app ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-21 02:16:13 UTC (by PhishDestroy tracker) Last verified: 2026-07-22 20:20:23 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f8206-1967-700e-857c-90a687a2ac25/ Wayback Machine: https://web.archive.org/web/*/secure-page-builder--daklmk.replit.app crt.sh CT logs: https://crt.sh/?q=%25.secure-page-builder--daklmk.replit.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=secure-page-builder--daklmk.replit.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/secure-page-builder--daklmk.replit.app URLhaus: https://urlhaus.abuse.ch/host/secure-page-builder--daklmk.replit.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-21 02:17:33 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] secure-page-builder--daklmk.replit.app: Credential Phishing The domain secure-page-builder--daklmk.replit.app is flagged as an active credential‑phishing site as of July 21, 2026. Infrastructure analysis shows the domain resolves to the IPv4 address 34.117.33.233, which belongs to the Replit Inc. hosting platform. Registration records indicate the domain was created through Replit Inc., confirming that the attacker is leveraging a legitimate development service to host the malicious payload. The domain appears on one external security blocklist and has been specifically blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. VirusTotal scans report that 13 of 95 security vendors have flagged the domain, providing independent corroboration of its phishing nature. DNS queries return NS_NOT_FOUND, meaning no authoritative name‑server information is available; this limits the ability to trace the underlying DNS configuration but does not diminish the risk. Current evidence does not include SSL/TLS details, HTTP response codes, page titles, or brand targeting, so the exact content of the hosted page remains unverified. Defenders should treat any traffic to or from this domain and its IP address as hostile. Immediate mitigation steps include adding the domain and the associated IP address to network‑level blocklists, updating intrusion‑detection signatures to flag outbound connections to 34.117.33.233, and monitoring DNS logs for any resolution attempts. Organizations using Replit for development should review usage policies and consider reporting the abuse to Replit’s abuse team to expedite takedown. Continuous monitoring of threat‑intel feeds for additional indicators related to this domain is recommended, as further analysis may reveal the specific credential‑harvesting tactics employed. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: a12f2e822849b9ecff39647f2906061a178fa6c8299cbb261168850e42d826fd ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/secure-page-builder--daklmk.replit.app/ JSON API: https://api.destroy.tools/v1/check?domain=secure-page-builder--daklmk.replit.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,333 domains (57,778 alive under monitoring, 128,922 confirmed takedowns/dead). Site: https://phishdestroy.io