secure-page-builder--benworthington[.]replit[.]app

The domain secure-page-builder--benworthington.replit.app is currently active and has been observed hosting credential‑phishing infrastructure. Analysis shows the domain resolves to the IP address 34.117.33.233, which is owned by Replit Inc., the registrar listed in the registration data. Google Safe Browsing flags the host for social engineering, indicating that the URL is being used to lure users into disclosing credentials. The domain appears on two independent phishing blocklists—PhishDestroy and OpenPhish—demonstrating that multiple threat‑intel feeds have already identified it as malicious.

VirusTotal has recorded 17 detections out of 91 security‑vendor scans, confirming that a notable minority of AV engines consider the domain malicious. No additional metadata such as SSL certificate details, HTTP response codes, or page title is available from the supplied intelligence, so the exact appearance of the landing page remains unverified. The absence of a nameserver record (NS_NOT_FOUND) suggests that the domain may be using Replit’s default DNS configuration, which can complicate takedown efforts. Defenders should immediately block traffic to 34.117.33.233 and to the full domain name at the network perimeter, add the host to internal blocklists, and monitor for any outbound connections from internal clients to the URL.

Continuous re‑scanning on VirusTotal and periodic checks of Google Safe Browsing are recommended to capture any changes in detection status. Because the domain is registered through a legitimate cloud‑hosting provider, coordinated reporting to Replit’s abuse contact may expedite remediation, though the provider’s response time can vary. Overall, the observable evidence points to a high‑risk credential‑phishing operation that remains active and should be treated with caution by security teams.