# PhishDestroy domain threat record: ubiipagos--prestamoubii000.replit.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/ubiipagos--prestamoubii000.replit.app/ Machine-readable companion: https://phishdestroy.io/domain/ubiipagos--prestamoubii000.replit.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-17 03:12:00 UTC - Last availability or vendor check: 2026-10-23 22:09:06 UTC - Stored record updated: 2026-10-23 22:23:03 UTC - VirusTotal detections in the stored snapshot: 5/89 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 34.117.33.233 - Registrar in stored WHOIS data: Nom-IQ Limited dba Com Laude - Last stored HTTP status: 301 - Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/ubiipagos--prestamoubii000.replit.app - Certificate Transparency search: https://crt.sh/?q=%25.ubiipagos--prestamoubii000.replit.app - Web Archive lookup: https://web.archive.org/web/*/https://ubiipagos--prestamoubii000.replit.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview ubiipagos--prestamoubii000.replit.app is an impersonation phishing page hosted on Replit's shared app platform. Its hostname combines the Ubii Pagos payment brand with "prestamo", Spanish for loan, which points to Spanish-speaking Ubii users looking for quick credit. PhishDestroy first flagged it on 2026-09-17. As of 2026-10-19 the site was still online and returning a redirect. How the scam works Fake loan pages built on a payment brand's name usually promise fast approval, then ask for login credentials, card or bank details, ID documents, or an upfront "processing" or "insurance" fee before any money is released. The loan never arrives. The victim loses the fee and hands over an account that can be emptied or reused for further fraud. When we checked, the page title read "This app isn't live yet", Replit's placeholder text, while our classification is impersonation phishing. Evidence On 2026-09-23, VirusTotal showed 5 of 89 engines flagging the address: ChainPatrol, alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and LevelBlue. That count is low, so most security tools will not warn visitors. The page also appears on the PhishDestroy, MetaMask and SEAL blocklists, which gives wallet users and browser extensions that consume those lists a second layer of protection. Infrastructure The 2021-04-16 registration date and the Nom-IQ Limited dba Com Laude registrar belong to Replit's parent domain, not to the operator. Anyone can create a subdomain like this in minutes at no cost. Traffic is served from Google LLC infrastructure in the US, and the Google Trust Services certificate is issued automatically to every Replit app. The padlock in the browser therefore says nothing about who runs the page. What to do Ubii Pagos does not lend money through Replit subdomains, so treat any loan offer here as fraudulent and never pay an advance fee. If you entered a Ubii password, change it from the official app and enable two-factor authentication. If you shared card or bank details, contact your bank to block the card and dispute charges. If you uploaded ID documents, watch for accounts opened in your name. Defenders should block the full hostname, report it to Replit's abuse team, and alert Ubii's security contacts so they can warn customers. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/ubiipagos--prestamoubii000.replit.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ubiipagos--prestamoubii000.replit.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:58:01 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/633d34ea-d160-4143-9c4b-ac7c3730a536.png Captured: 2026-09-23 08:07:12 UTC Source report: https://radar.cloudflare.com/scan/633d34ea-d160-4143-9c4b-ac7c3730a536 SHA-256: a5ac8eda517ee37d65362de04b34d7edcf44e77812a3438153e2c14b97e0e85d - URLScan ยท 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ad61-4d31-73bb-a910-e3ed3b9e39a2.png Captured: 2026-09-17 03:20:46 UTC Source report: https://urlscan.io/result/01a0ad61-4d31-73bb-a910-e3ed3b9e39a2/ SHA-256: 5fa698485cff098b2786c203b0c7c56d76caf853283d083216ddc8666043d202 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:43Z", "uuid": "633d34ea-d160-4143-9c4b-ac7c3730a536", "scanned_at": "2026-09-23T08:07:12Z", "final_url": "https://ubiipagos--prestamoubii000.replit.app/", "status": 404, "history": [ { "url": "https://ubiipagos--prestamoubii000.replit.app/", "status": 404 } ], "dom_hash": "bebe73542fb033badbed0a2bc2f53b7deaa7a02e93da346597768b0124b34ee7", "doc_hash": "13f006dcbc81382b0c7e643fd5463be6bd2e6355da7bc5eca98e316000a80290", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ubiipagos--prestamoubii000.replit.app", "type": "A", "value": "34.117.33.233" } ], "dnssec_valid": false, "ip": "34.117.33.233", "whois": { "registrar": "Nom-IQ Limited dba Com Laude", "created": "2021-04-16T20:44:58Z", "updated": "2025-10-10T03:54:10Z", "expires": "2034-04-16T20:44:58Z", "nameservers": [ "ns-cloud-b1.googledomains.com", "ns-cloud-b2.googledomains.com", "ns-cloud-b3.googledomains.com", "ns-cloud-b4.googledomains.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:28:06Z", "analysis_at": "2026-09-16T11:03:51Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 5, "suspicious": 0, "undetected": 36 }, "detections": { "CRDF": "malicious", "LevelBlue": "phishing", "ChainPatrol": "malicious", "alphaMountain.ai": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Information Technology, Malicious (alphaMountain.ai)" }, "created": "2021-04-16T00:00:00Z", "updated": "2025-12-04T00:00:00Z", "first_seen": "2026-09-16T11:26:01Z", "dns": [ { "ttl": 3600, "type": "A", "value": "34.117.33.233" } ], "dns_at": "2026-09-16T11:26:01Z", "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84", "cert": { "san": [ "replit.app", "*.replit.app" ], "issuer": "Google Trust Services / WR3", "serial": "b3df8d4daf091430a5fcdb9944aa352", "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae", "subject": "replit.app", "valid_to": "2026-12-01T12:25:50Z", "valid_from": "2026-09-02T11:30:15Z" }, "whois": [] } } ```