# PhishDestroy domain threat record: security-server-page--jhalskov68.replit.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/security-server-page--jhalskov68.replit.app/ Machine-readable companion: https://phishdestroy.io/domain/security-server-page--jhalskov68.replit.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-13 12:38:46 UTC - Last availability or vendor check: 2026-10-23 22:08:43 UTC - Stored record updated: 2026-10-23 22:22:36 UTC - VirusTotal detections in the stored snapshot: 22/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 34.117.33.233 - Registrar in stored WHOIS data: Nom-IQ Limited dba Com Laude - Last stored HTTP status: 301 - Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0c0d9-189c-752a-adbe-dfaf27ea6d63/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/security-server-page--jhalskov68.replit.app - Certificate Transparency search: https://crt.sh/?q=%25.security-server-page--jhalskov68.replit.app - Web Archive lookup: https://web.archive.org/web/*/https://security-server-page--jhalskov68.replit.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This is an impersonation phishing page hosted as a user app on Replit. Its hostname, which begins with "security-server-page", is built to look like an official security or account-verification step. PhishDestroy first flagged it on 2026-09-13. On 2026-10-19 the site was still alive and its content was reachable through a redirect. How the scam works Impersonation pages like this borrow the look and language of a trusted service, often presented as an urgent security check. The victim is pushed to type in login details, verification codes or wallet recovery information, and the operator collects them. Those credentials can then be used to take over accounts or empty funds. The current page title reads "This app isn't live yet", which is Replit's placeholder text, while we classify the app as impersonation phishing. Evidence On 2026-09-19, VirusTotal showed 22 of 89 security engines flagging the address as malicious, which is a substantial number of independent vendors for a single app subdomain. The flagging vendors include BitDefender, ESET, Emsisoft, alphaMountain.ai, CRDF, CyRadar, Ermes and the Vietnamese anti-scam group Chong Lua Dao. The PhishDestroy blocklist carries it as well. Infrastructure The replit.app parent domain was registered on 2021-04-16 through Nom-IQ Limited dba Com Laude and belongs to the platform, not to this operator. Its age says nothing about how long this particular app has existed. Traffic resolves to Google LLC infrastructure in the US, and the TLS certificate comes from Google Trust Services (WR3). Because the certificate is issued at the platform level, the browser padlock offers no assurance that this page is legitimate. What to do If you entered a password on this page, change it right away on the real service and on any other site where you reused it, then turn on or reset two-factor authentication and sign out of all active sessions. If you typed in a wallet recovery phrase, treat that wallet as compromised and move your funds to a newly created wallet. Defenders should block the full hostname, report the app to Replit's abuse team for removal, and search proxy and mail logs for users who opened it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0c0d9-189c-752a-adbe-dfaf27ea6d63/ VirusTotal report: https://www.virustotal.com/gui/domain/security-server-page--jhalskov68.replit.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=security-server-page--jhalskov68.replit.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:43:28 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0c0d9-189c-752a-adbe-dfaf27ea6d63.png Captured: 2026-09-13 12:38:46 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0c0d9-189c-752a-adbe-dfaf27ea6d63.png Captured: 2026-09-22 03:32:36 UTC Source report: https://urlscan.io/result/01a0c0d9-189c-752a-adbe-dfaf27ea6d63/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1b9fe018-5229-4d40-b58d-8fb573b63e5c.png Captured: 2026-09-14 07:55:08 UTC Source report: https://radar.cloudflare.com/scan/1b9fe018-5229-4d40-b58d-8fb573b63e5c SHA-256: 856e71bbeaf3fe4dd75aac0c0a63a0024a26d242987cf81a7ab37764ea98bee7 - URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09aca-60ef-72d2-9a9c-d11d041a593b.png Captured: 2026-09-13 12:42:36 UTC Source report: https://urlscan.io/result/01a09aca-60ef-72d2-9a9c-d11d041a593b/ SHA-256: ed8e97f1c849ee0c372c05fb3e380252ae1df5610a2d30afd57763ff88c4534d - URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09adc-8039-7550-b91f-1ef439dbad69.png Captured: 2026-09-13 13:02:23 UTC Source report: https://urlscan.io/result/01a09adc-8039-7550-b91f-1ef439dbad69/ SHA-256: ed8e97f1c849ee0c372c05fb3e380252ae1df5610a2d30afd57763ff88c4534d - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aa7a-c1b9-75a9-8b91-c38c8cc9ba03.png Captured: 2026-09-16 13:49:33 UTC Source report: https://urlscan.io/result/01a0aa7a-c1b9-75a9-8b91-c38c8cc9ba03/ SHA-256: 8a38048ff35027382671fe7911dd42eb85b20979cbe415fa93f740bba3a06a8c - URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b35c-336d-706a-9bb5-41004859283e.png Captured: 2026-09-18 07:12:44 UTC Source report: https://urlscan.io/result/01a0b35c-336d-706a-9bb5-41004859283e/ SHA-256: e75825bb50c40bf08f9c5f19c02708d7c67158eb17988ae7a99983e4637a2212 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T22:24:46Z", "uuid": "01a0c0d9-189c-752a-adbe-dfaf27ea6d63", "scanned_at": "2026-09-20T22:04:19Z", "final_url": "https://security-server-page--jhalskov68.replit.app/", "status": 404, "ip": "34.117.33.233", "ptr": "233.33.117.34.bc.googleusercontent.com", "ips": [ "34.117.33.233" ], "asns": [ "396982" ], "countries": [ "US" ], "link_domains": [ "docs.replit.com", "replit.com" ], "doc_hash": "13f006dcbc81382b0c7e643fd5463be6bd2e6355da7bc5eca98e316000a80290", "globals": [ "reload_timeout" ], "tls": { "san": [ "replit.app", "*.replit.app" ], "cipher": "AES_128_GCM", "issuer": "WR3", "subject": "replit.app", "protocol": "TLS 1.3", "valid_to": "2026-12-01T12:25:50Z", "valid_from": "2026-09-02T11:30:15Z" }, "domain_age_days": 7, "apex_age_days": 7, "tls_age_days": 18, "tls_valid_days": 90, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 93, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:32:09Z", "uuid": "1b9fe018-5229-4d40-b58d-8fb573b63e5c", "scanned_at": "2026-09-14T07:55:08Z", "final_url": "https://security-server-page--jhalskov68.replit.app/", "status": 200, "history": [ { "url": "https://security-server-page--jhalskov68.replit.app/", "status": 200 } ], "dom_hash": "184f82ea2d97d6c1f2bb7b165fa6db530f982b752a8e0cc07cdd7af30f5ad3b1", "doc_hash": "7e08398ea6510891c5b8295c7efbd957a427f256a43922752cee0346e755ecd2", "phishing": [ "Credential Harvester" ], "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "security-server-page--jhalskov68.replit.app", "type": "A", "value": "34.117.33.233" } ], "dnssec_valid": false, "ip": "34.117.33.233", "verdict": { "tags": [ "phishing", "Credential Harvester" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Nom-IQ Limited dba Com Laude", "created": "2021-04-16T20:44:58Z", "updated": "2025-10-10T03:54:10Z", "expires": "2034-04-16T20:44:58Z", "nameservers": [ "ns-cloud-b1.googledomains.com", "ns-cloud-b2.googledomains.com", "ns-cloud-b3.googledomains.com", "ns-cloud-b4.googledomains.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T03:23:06Z", "analysis_at": "2026-10-13T15:32:02Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 17, "suspicious": 2, "undetected": 31 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "Ermes": "not recommended", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "malware", "Fortinet": "phishing", "URLQuery": "malicious", "LevelBlue": "suspicious", "Gridinsoft": "phishing", "MalwareURL": "phishing", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2021-04-16T00:00:00Z", "updated": "2025-12-04T00:00:00Z", "first_seen": "2026-09-13T10:14:33Z", "dns": [ { "ttl": 3600, "type": "A", "value": "34.117.33.233" } ], "dns_at": "2026-10-13T15:53:24Z", "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84", "cert": { "san": [ "replit.app", "*.replit.app" ], "issuer": "Google Trust Services / WR3", "serial": "b3df8d4daf091430a5fcdb9944aa352", "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae", "subject": "replit.app", "valid_to": "2026-12-01T12:25:50Z", "valid_from": "2026-09-02T11:30:15Z" }, "whois": [] } } ```