secure-page-creator--wolfwise[.]replit[.]app

The domain secure-page-creator--wolfwise.replit.app has been identified as a credential phishing resource targeting user account credentials. Analysis indicates the page was designed to impersonate legitimate authentication portals, as evidenced by its page title, 'Sign in to your account.' The domain is currently offline, though prior activity suggests it was actively used for malicious credential harvesting operations. Infrastructure analysis reveals the domain was registered through Replit and resolved to the IP address 34.117.33.233. Security vendor detections on VirusTotal indicate that 18 of 95 engines flagged the domain as malicious. The SSL certificate is issued by Google Trust Services under the WR3 intermediate, a common characteristic of both legitimate and malicious web properties. The domain appears on one security blocklist, further corroborating its association with phishing activity. No additional historical registration data or creation date was available for deeper temporal analysis. At present, the domain has been taken offline, reducing immediate risk to end users. However, similar infrastructure may still be operational under different subdomains or aliases. Users are advised to verify the authenticity of any authentication portal before entering credentials, particularly those hosted on non-corporate domains. Organizations should monitor for indicators of compromise, including the IP address 34.117.33.233 and the Replit subdomain pattern, and update blocklists accordingly to prevent access to related malicious resources.