757cd1be-caf3-4f80-a41c-cce6f5c7cf14-00-n6g9vgcw7z72[.]spock[.]replit[.]dev

Analysis indicates that the domain 757cd1be-caf3-4f80-a41c-cce6f5c7cf14-00-n6g9vgcw7z72.spock.replit.dev is presently active and associated with a generic phishing campaign. The domain resolves to the IP address 8.231.205.6 and was registered through Replit Inc., a provider of cloud‑based development environments. VirusTotal records show that 13 of 91 security engines have flagged the domain, reflecting a measurable level of detection across multiple scanning products. The domain appears on one external blocklist and is actively blocked by the PhishDestroy feed, demonstrating that community‑maintained security sources have identified it as malicious.

Google Safe Browsing categorises the site as "social engineering," which is consistent with the phishing designation. DNS queries return an error for nameserver information (NS_NOT_FOUND), indicating that authoritative name server details are not publicly resolvable. No additional data such as SSL certificates, HTTP status codes, page titles, or content snapshots are presently available. Uncertainties remain regarding the specific payload delivered to victims, the geographic location of the hosting infrastructure beyond the resolved IP, and whether any secondary command‑and‑control endpoints are employed.

Defenders should proactively block the IP address 8.231.205.6 at network perimeters and add the full domain to URL filtering and web proxy policies. Email security gateways should be updated to flag any messages containing URLs that resolve to the spock.replit.dev sub‑domain, and SOC analysts should search logs for credential‑theft or login‑credential submissions linked to this host. Continuous monitoring of DNS logs for look‑ups to the 757cd1be‑caf3‑4f80‑a41c‑cce6f5c7cf14‑00‑n6g9vgcw7z72.spock.replit.dev pattern is recommended, as is the inclusion of the domain in threat‑intelligence feeds that support automated blocklist updates.