secure-static-host--trena1snfmaz[.]replit[.]app

The domain secure-static-host--trena1snfmaz.replit.app was registered on April 16, 2021 through the Replit hosting platform. Analysis of public threat feeds shows that the domain is currently active and is being used for credential phishing campaigns. It has been added to the PhishDestroy blocklist, indicating that at least one anti‑phishing service has confirmed malicious activity. VirusTotal scans report that 20 out of 91 security vendors flag the domain as malicious, reinforcing the suspicion of abuse.

Additionally, the domain appears on a single external blocklist, which further corroborates its reputation as a hostile resource. No publicly available information on the underlying IP address, SSL certificate details, HTTP response codes, or page title has been disclosed, leaving those infrastructure attributes unverified at this time. The absence of such data does not preclude malicious use but limits the depth of technical attribution. Defenders should treat any traffic to this domain as high‑risk and block it at network perimeter devices, DNS filters, and endpoint protection suites.

Continuous monitoring of the domain’s resolution patterns and any future VirusTotal updates is recommended to capture changes in detection scores. Organizations should also educate users about the risk of credential harvesting associated with Replit‑hosted subdomains, especially when unsolicited login prompts appear. In summary, the combination of registration details, blocklist inclusion, and multi‑vendor detection makes the domain a confirmed credential phishing threat, and proactive blocking is advised while further investigation of its hosting infrastructure continues.