secure-page-builder--heidimarie03[.]replit[.]app

The domain secure-page-builder--heidimarie03.replit.app is confirmed to be engaged in credential phishing activity as of August 07, 2026. Multiple sources indicate a high risk: 15 out of 91 security vendors on VirusTotal have flagged this domain, and it is listed on at least one security blocklist. Notably, the domain is actively blocked by PhishDestroy, underscoring its recognition among professional threat intelligence services. Google Safe Browsing further identifies the domain for social engineering, which is consistent with phishing operations targeting user credentials.

The domain is registered through Replit and currently resolves to the IP address 34.117.33.233. At this time, there is no additional evidence regarding the specific phishing kit used, the targeted brand, or the exact content hosted on the site, as no page title or further content analysis details have been provided. The domain remains active, and there is no indication it has been taken down or remediated.

Defenders should treat this domain as a significant ongoing threat. Immediate action is recommended: block all access at the network perimeter, update security controls to detect references to this domain, and monitor for related infrastructure using the provided IP address as an indicator. Since the domain is already present on both blocklists and Google’s Safe Browsing, it is likely to be part of a broader phishing campaign. Further monitoring for related domains registered via Replit or sharing the same IP is advised. No attribution or targeting details are available at this stage, so all user populations should be considered at risk until more context is obtained.