westernunion-pps[.]replit[.]app

This domain, westernunion-pps.replit.app, is identified as a high-risk phishing site designed to impersonate Western Union, a global money transfer service. Analysis indicates the threat type is generic phishing with a focus on brand impersonation, likely targeting users to harvest login credentials, personal information, or financial details. The domain does not exhibit direct indicators of a crypto drainer kit but follows patterns consistent with credential theft and fraudulent transaction redirection. No specific phishing kit signatures were observed in initial scans, though further forensic analysis of the page source may reveal obfuscated JavaScript or hidden form submissions. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in malicious classification. It was registered through Nom-IQ Limited dba Com Laude, a registrar commonly associated with both legitimate and malicious domains. The domain resolves to the IP address 34.117.33.233, hosted on autonomous system AS396982 (Google LLC) in the United States. The creation date of February 21, 2026, is anomalous, suggesting either a typo-squatting attempt or a misreported registration date, as this predates the current date. Google Safe Browsing explicitly flags the domain as phishing, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services under the WR3 intermediate, which does not inherently indicate malicious activity but is consistent with domains hosted on cloud platforms. As of the latest verification, westernunion-pps.replit.app has been taken offline, reducing immediate exposure to end users. However, the domain remains registered and could be reactivated or repurposed for further malicious activity. Response actions should include monitoring for DNS reactivation, analyzing historical WHOIS data for patterns, and cross-referencing the IP address with other known malicious domains. Users who accessed the domain prior to takedown are advised to reset credentials for Western Union and any associated financial accounts, enable multi-factor authentication, and scan local systems for malware. Organizations should update blocklists to include this domain and its resolving IP to prevent future access attempts.