secure-page-builder--leahgreene806a3[.]replit[.]app

This domain, secure-page-builder--leahgreene806a3.replit.app, is currently active and hosted on the Replit platform. DNS resolution points to the IPv4 address 34.117.33.233, an address that belongs to Amazon Web Services in the US East (N. Virginia) region, a common hosting environment for short‑lived malicious pages. The domain lacks publicly visible nameserver records, which often indicates use of Replit’s internal DNS handling or a recent creation that has not propagated fully.

VirusTotal has recorded six detections out of ninety‑one scanned scanners, confirming that at least a subset of security vendors have observed malicious behavior associated with the host. The domain is listed on a public phishing blocklist and is actively blocked by the PhishDestroy filtering service, reinforcing the classification as a credential‑phishing site. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or Safe Browsing verdicts is presently available, leaving the exact content of the site unverified. Because the registrar is Replit Inc., standard abuse‑reporting channels for the registrar should be used to request takedown.

Defenders should add the full domain name and its resolving IP address to DNS‑based block lists, enforce URL filtering rules that deny any outbound connections to the address, and monitor for any authentication attempts that target credential‑submission endpoints that might be hosted on this host. Network‑level alerts for traffic to 34.117.33.233, especially from corporate workstations, should be escalated for investigation. Continuous re‑scanning of the domain with multi‑engine services is recommended, as new detections may appear if the site evolves. In the absence of a known brand target, the risk remains high due to the confirmed phishing classification and the active hosting environment.