# PhishDestroy domain threat record: security-server-landing-page--dianneaagroo.replit.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/security-server-landing-page--dianneaagroo.replit.app/
Machine-readable companion: https://phishdestroy.io/domain/security-server-landing-page--dianneaagroo.replit.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-07 00:26:34 UTC
- Last availability or vendor check: 2026-10-23 22:08:18 UTC
- Stored record updated: 2026-10-23 23:55:23 UTC
- VirusTotal detections in the stored snapshot: 21/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 34.117.33.233
- Registrar in stored WHOIS data: Nom-IQ Limited dba Com Laude
- Last stored HTTP status: 301
- Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08565-d625-755f-b108-91d34f91466a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/security-server-landing-page--dianneaagroo.replit.app
- Certificate Transparency search: https://crt.sh/?q=%25.security-server-landing-page--dianneaagroo.replit.app
- Web Archive lookup: https://web.archive.org/web/*/https://security-server-landing-page--dianneaagroo.replit.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This is an impersonation phishing page hosted as a user app on Replit's public app platform. Its subdomain is built to read like an official security server landing page, a framing aimed at wallet and account holders who expect to act on an urgent security warning. PhishDestroy first flagged it on 2026-09-07. On 2026-10-19 the address was still alive and redirecting visitors elsewhere.

How the scam works
Security-themed phishing pages claim that an account or wallet is at risk, then push the visitor to verify their identity. They do this by having the visitor sign in, enter a recovery phrase or approve an action, and whatever is typed goes straight to the operator. Because the address now redirects, the page a victim actually lands on may differ from the original lure. The page title currently reads "This app isn't live yet", Replit's placeholder text, while our classification is impersonation phishing.

Evidence
On 2026-09-17, 21 of 89 VirusTotal engines flagged the address. Among them were BitDefender, ESET, Emsisoft, Criminal IP, alphaMountain.ai, CRDF, CyRadar and the Vietnamese anti-scam group Chong Lua Dao. Google Safe Browsing lists it under social engineering, so Chrome, Firefox and Safari users should see a red warning screen before the page loads. PhishDestroy carries it on its blocklist.

Infrastructure
The 2021-04-16 registration date and the Com Laude registrar belong to replit.app itself, not to the scammer. The operator only needed a free subdomain on a trusted platform, which explains how the lure could be launched quickly and cheaply. Traffic is served from Google LLC infrastructure in the US. The HTTPS certificate from Google Trust Services is issued automatically to every Replit app, so the padlock says nothing about who runs this page.

What to do
If you typed a password or one-time code here, change that password now, end active sessions and reset two-factor authentication on the affected account. If you entered a seed phrase or private key, treat the wallet as compromised and move your funds to a new wallet created on a clean device. If you connected a wallet and signed anything, review and revoke token approvals with a revocation tool. Defenders should block the full hostname, not replit.app as a whole, and report the app to Replit for removal.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08565-d625-755f-b108-91d34f91466a/
VirusTotal report: https://www.virustotal.com/gui/domain/security-server-landing-page--dianneaagroo.replit.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=security-server-landing-page--dianneaagroo.replit.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:48:21 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a08565-d625-755f-b108-91d34f91466a.png
  Captured: 2026-09-07 00:26:34 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a08565-d625-755f-b108-91d34f91466a.png
  Captured: 2026-09-22 03:32:43 UTC
  Source report: https://urlscan.io/result/01a08565-d625-755f-b108-91d34f91466a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d34805d1-9b33-48b2-94ea-07eff6aec92c.png
  Captured: 2026-09-15 13:11:20 UTC
  Source report: https://radar.cloudflare.com/scan/d34805d1-9b33-48b2-94ea-07eff6aec92c
  SHA-256: de4570eaf70a0ca4fa6ba0a0636b123c82cfa53974207cb5a94da74b8d34a8e9
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07945-8bf5-75dc-aafc-1f6fafbab998.png
  Captured: 2026-09-07 00:30:11 UTC
  Source report: https://urlscan.io/result/01a07945-8bf5-75dc-aafc-1f6fafbab998/
  SHA-256: 94c6f03ffa2253f27050195e012d5260b3f126c2c6b3f5886585f5ea766b9203
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07964-2c8c-760d-b7be-1c6220753987.png
  Captured: 2026-09-07 01:03:28 UTC
  Source report: https://urlscan.io/result/01a07964-2c8c-760d-b7be-1c6220753987/
  SHA-256: e2f6210a4e0615b67b6ef712b8e94fb6b424a6758d0473a94729bce67a33ded0
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07999-44e3-76cc-868d-952a8679fba4.png
  Captured: 2026-09-07 02:01:32 UTC
  Source report: https://urlscan.io/result/01a07999-44e3-76cc-868d-952a8679fba4/
  SHA-256: a7202fbd7e11368439b05a33d826e1dafb8f475b6a743ffb760e0f941d4d8cd9
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07a05-f707-769a-9b7b-61953e9a206c.png
  Captured: 2026-09-07 04:00:17 UTC
  Source report: https://urlscan.io/result/01a07a05-f707-769a-9b7b-61953e9a206c/
  SHA-256: afd8144469338421a5df05e0a98cf476faa7b8c0ea24342ee70186db0f68fd2a
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07a21-d7e9-73c7-9109-48cccc09ba7e.png
  Captured: 2026-09-07 04:30:39 UTC
  Source report: https://urlscan.io/result/01a07a21-d7e9-73c7-9109-48cccc09ba7e/
  SHA-256: e2f6210a4e0615b67b6ef712b8e94fb6b424a6758d0473a94729bce67a33ded0
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07b91-cd96-76ea-8da7-9c4bbab474ae.png
  Captured: 2026-09-07 11:12:35 UTC
  Source report: https://urlscan.io/result/01a07b91-cd96-76ea-8da7-9c4bbab474ae/
  SHA-256: b8397793a8090a2e73c8291db620a1749e8419c131411c23971d799532a4cc0c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:13:15Z",
        "uuid": "01a08565-d625-755f-b108-91d34f91466a",
        "scanned_at": "2026-09-09T09:00:45Z",
        "final_url": "https://security-server-landing-page--dianneaagroo.replit.app/",
        "status": 404,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://security-server-landing-page--dianneaagroo.replit.app/",
                "from": "http://security-server-landing-page--dianneaagroo.replit.app/",
                "status": 307
            }
        ],
        "ip": "34.117.33.233",
        "ptr": "233.33.117.34.bc.googleusercontent.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.14.94",
            "142.251.20.95",
            "34.117.33.233"
        ],
        "asns": [
            "15169",
            "396982"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "docs.replit.com",
            "replit.com"
        ],
        "doc_hash": "171a60dd37ccb5d46e6a8bece68684ecc1e1502a632a6ef9883c367fb44877db",
        "globals": [
            "reload_timeout"
        ],
        "tls": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR3",
            "subject": "replit.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 6,
        "tls_valid_days": 90,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:24:44Z",
        "uuid": "d34805d1-9b33-48b2-94ea-07eff6aec92c",
        "scanned_at": "2026-09-15T13:11:20Z",
        "final_url": "https://security-server-landing-page--dianneaagroo.replit.app/",
        "status": 404,
        "history": [
            {
                "url": "https://security-server-landing-page--dianneaagroo.replit.app/",
                "status": 404
            }
        ],
        "dom_hash": "56ff95bd24b5e042d0ffbbb6fb629df7a4e4f2e37588963dc702708d85b7d8b1",
        "doc_hash": "171a60dd37ccb5d46e6a8bece68684ecc1e1502a632a6ef9883c367fb44877db",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "security-server-landing-page--dianneaagroo.replit.app",
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dnssec_valid": false,
        "ip": "34.117.33.233",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Nom-IQ Limited dba Com Laude",
            "created": "2021-04-16T20:44:58Z",
            "updated": "2025-10-10T03:54:10Z",
            "expires": "2034-04-16T20:44:58Z",
            "nameservers": [
                "ns-cloud-b1.googledomains.com",
                "ns-cloud-b2.googledomains.com",
                "ns-cloud-b3.googledomains.com",
                "ns-cloud-b4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T10:32:11Z",
        "analysis_at": "2026-10-22T04:46:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 21,
            "suspicious": 0,
            "undetected": 29
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "ESET": "phishing",
            "VIPRE": "malware",
            "G-Data": "malware",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "URLQuery": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Criminal IP": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2021-04-16T00:00:00Z",
        "updated": "2025-12-04T00:00:00Z",
        "first_seen": "2026-09-04T23:12:20Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dns_at": "2026-10-22T04:51:46Z",
        "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84",
        "cert": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "issuer": "Google Trust Services / WR3",
            "serial": "b3df8d4daf091430a5fcdb9944aa352",
            "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae",
            "subject": "replit.app",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "whois": []
    }
}
```