secure-page-creator--george-x-x[.]replit[.]app

The domain secure-page-creator--george-x-x.replit.app is presently active and has been classified as a credential phishing infrastructure. Registration data shows the domain was created through Replit Inc., a cloud development platform that frequently provisions short‑lived subdomains for user projects. DNS resolution points exclusively to the IP address 34.117.33.233; no alternate A or CNAME records were observed, and the authoritative nameserver query returned NS_NOT_FOUND, indicating that the domain’s nameserver information is unavailable or intentionally concealed.

Google Safe Browsing has flagged the site for social engineering, and the domain appears on one external security blocklist, confirming that at least one defensive feed has identified it as malicious. VirusTotal analysis reports that 7 out of 91 scanned security vendors marked the domain as suspicious, providing independent corroboration of its malicious intent. The PhishDestroy blocklist explicitly lists the domain as blocked, reinforcing the consensus that it is being used for credential harvesting.

Current intelligence does not contain details on SSL/TLS configuration, HTTP response codes, page titles, or any observable brand targeting, leaving the exact phishing lure undefined. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole entries, and monitor outbound connections to 34.117.33.233 for anomalous activity. Incident response teams are advised to treat any credentials submitted to this host as compromised, enforce credential rotation for affected accounts, and consider user education campaigns that reference the domain’s association with credential phishing to mitigate future exposure.