secure-page-builder--nidala77[.]replit[.]app

The domain secure-page-builder--nidala77.replit.app is currently active and has been identified as a credential‑phishing infrastructure. It is hosted on the IP address 34.117.33.233, which is owned by the cloud platform Replit Inc. The registration record confirms that the domain was created through Replit’s public registration service, indicating that the attacker leveraged a legitimate developer‑oriented hosting environment to obtain a short‑lived, low‑cost web presence. Nameserver information is unavailable, as the domain returns NS_NOT_FOUND, which may be a result of the rapid provisioning model used by the provider or an attempt to obscure DNS resolution details. Detection data show that six of ninety‑one security vendors on VirusTotal have flagged the domain, suggesting that at least a minority of scanning engines have observed malicious activity associated with the host.

The domain is also listed on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that threat‑intelligence feeds have recognized it as hostile. No additional public reputation signals—such as Safe Browsing, OTX, or SSL certificate metadata—are presently available. Given the limited but concrete evidence, analysts should treat this domain as high‑risk for credential‑phishing attempts.

Defensive actions include adding the IP address 34.117.33.233 to network‑level deny lists, updating URL filtering policies to block the full hostname, and ensuring that endpoint protection solutions monitor for the six vendor detections reported by VirusTotal. Because the domain resides on a shared cloud platform, rapid takedown may be possible through the hosting provider’s abuse reporting channel; security teams should submit a takedown request to Replit Inc. with the observed indicators. Continuous monitoring of the IP range and any newly resolved subdomains is advised, as the attacker may spawn additional phishing sites using the same infrastructure.