secure-index-edit--mlcrawford[.]replit[.]app

This domain, secure-index-edit--mlcrawford.replit.app, is confirmed to host a credential phishing site designed to harvest Microsoft Outlook login credentials. Analysis indicates the page title explicitly mimics the legitimate Outlook sign-in portal, suggesting brand impersonation tactics targeting corporate and personal email users. No evidence of a crypto drainer or wallet hijacking kit was observed, but the site's focus on credential theft aligns with common adversary objectives for account takeover and lateral movement. Infrastructure analysis reveals the domain resolves to IP address 34.117.33.233, a Google Cloud-hosted endpoint. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while 20 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain is registered under Replit's app platform, which may obscure traditional WHOIS details such as creation date or registrar. No Google Safe Browsing (GSB) listing was observed at the time of analysis, though the domain remains active and unblocked by most enterprise security controls. Current status indicates the phishing site is still operational, posing an ongoing risk to users who may encounter it through email, social engineering, or malvertising vectors. Response actions should include immediate blocking of the domain and IP at the network perimeter, alongside user awareness training to recognize brand impersonation tactics. Remaining risk is classified as high due to the domain's active status, low detection rate among security vendors, and the potential for credential theft to enable further compromise of connected services or internal networks.