security-page-builder--lynnsspins[.]replit[.]app

Analysis indicates that the domain security-page-builder--lynnsspins.replit.app is currently active and associated with a generic phishing campaign. The domain resolves to the IPv4 address 34.117.33.233, which is hosted by Replit Inc., the registrar listed in the registration metadata. Infrastructure probing shows that the domain lacks publicly resolvable name server records, as the nameserver query returned NS_NOT_FOUND, suggesting either a misconfiguration or an attempt to obscure DNS details.

The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the view that it is being used for malicious purposes. VirusTotal scans have recorded seven detections out of ninety‑one security vendors, providing concrete vendor‑level corroboration of suspicious activity. No additional public signals such as Safe Browsing verdicts, SSL certificate details, or HTTP response codes are available at this time, and the page title has not been disclosed, leaving the visual content of the site unverified.

Given the high risk rating, the presence on a blocklist, and multiple vendor detections, defensive operators should consider immediate mitigation actions: add the domain and its resolved IP address to outbound and inbound deny lists, monitor DNS queries for the domain and related subdomains, and employ URL filtering to prevent user access. Continuous re‑evaluation is advised, as further intelligence may emerge regarding the site’s payload, hosting patterns, or target victims.