enel-rimborso[.]replit[.]app

Analysis of enel-rimborso.replit.app indicates a high-risk phishing domain targeting Enel customers, currently offline as of July 24, 2026. The domain, hosted on Google Cloud infrastructure (IP 34.117.33.233, AS396982 Google LLC), was flagged by 16 of 95 security vendors on VirusTotal and blocked by PhishDestroy. Google Safe Browsing classified the site as social engineering, aligning with its apparent billing refund theme. The domain's HTTP status returned a 500 Server Error, suggesting either a takedown or backend misconfiguration. SSL certificate issued by Google Trust Services (WR3) confirms encrypted connections, though this does not mitigate the phishing intent.

Infrastructure analysis reveals the domain was registered through Google's ASN 396982, leveraging Google Cloud, HSTS, and HTTP/3 technologies. No nameservers were detected (NS_NOT_FOUND), which may indicate a temporary or incomplete setup. The Scamadviser trust score of 1/100 further supports its malicious classification. While the exact content of the phishing kit remains unanalyzed, the domain name and Safe Browsing flags strongly suggest it impersonated Enel's billing or refund portal to harvest credentials or payment details.

Defenders should treat this domain as compromised and prioritize blocking at DNS and web gateway levels. The IP 34.117.33.233 and associated Google Cloud infrastructure should be monitored for additional phishing domains. Given the domain's current offline status, further forensic analysis may be limited, but historical WHOIS or passive DNS data could reveal registration patterns or linked campaigns. No evidence of lateral movement or C2 infrastructure was observed in the provided data.