simple-security-index--allaesthetics1[.]replit[.]app

This domain, simple-security-index--allaesthetics1.replit.app, is flagged as an active credential phishing site targeting user account logins. Analysis indicates the domain was registered on July 4, 2026, and remains operational as of July 12, 2026, with an HTTP 200 status. The page title, 'Sign in to your account,' aligns with typical phishing templates designed to harvest credentials. Infrastructure analysis reveals the domain resolves to IP 34.117.33.233, hosted on AS396982 (Google LLC) in the US, leveraging Google Cloud services, including Cloud CDN and Cloud Trace, alongside standard web technologies such as jQuery and HSTS. The SSL certificate is issued by Google Trust Services (WR3), which is consistent with legitimate cloud-hosted services but does not preclude malicious use. The domain appears on one security blocklist and is flagged by 21 of 91 security vendors on VirusTotal, confirming its detection as malicious. The scam type is explicitly classified as credential phishing, though the specific brand or service being impersonated is not identified in available data. Defenders should prioritize blocking this domain at the network level, particularly given its use of Google Cloud infrastructure, which may evade basic reputation-based filters. Monitoring for related subdomains or IPs within the same ASN (396982) is recommended to identify potential lateral movement or additional phishing endpoints. No evidence of takedown or remediation has been observed as of this assessment.