Phishing Pages Hosted on AI-based Site Builders

    Date: 10/22/2026

    Severity: High

    Summary

    Phishing pages hosted on AI-powered website builders are increasingly common and often have unique DOM hashes, making hash-based detection less effective. Despite these differences, many pages retain identifiable markers from the website builder within their HTML markup. Security teams can use these markers alongside common phishing indicators to identify suspicious pages more effectively. These pages frequently use modern JavaScript frameworks and include scripts that send submitted form data to popular messaging applications.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    https://alltijjarieywaffabnnk.lovable.app

    https://attwebupdate4085j483hj392.framer.ai

    https://banknagar-info.netlify.app

    https://binance-support-pro.lovable.app

    https://bitkey-cloud-wallet.created.app

    https://bnidirectbnilogin.netlify.app

    https://brazil-documento-brazil-documento.framer.ai

    https://bybit-logi-auth.created.app

    https://coenbase-pro-secure.created.app

    https://cred-agric.netlify.app

    https://credi-pc--jonfervera4.replit.app

    https://desenrola-aprovado.lovable.app

    https://frabjous-druid-8cf591.netlify.app

    https://freerobox2434w.netlify.app

    https://hh6515.craftum.io

    https://kucoin-home.created.app

    https://minimal-centered-car-23p0.bolt.host

    https://myjunoupdatenow.framer.website

    https://mytalktalkbroadbandteam.framer.website

    https://qill.netlify.app

    https://regal-specukam.netlify.app

    https://seashell-owl-632549.hostingersite.com

    https://secure-server-hub--no-replysignin.replit.app

    https://security-server-landing-page--009wq.replit.app

    https://security-server-page--lizma150.replit.app

    https://security-server-page--mhamiltonhunter.replit.app

    https://shy84cy2cpklpedzwvshy84cy2cpklpedzwv-fidelty-com.replit.app

    https://site-pearl-portal-23f1.surge.sh

    https://square-coin-cloud.created.app

    https://subtle-belekoy-f2a734.netlify.app

    https://trust-guide-hero.lovable.app

    https://vinte-setup.bolt.host

    https://zoom-web3-longma-7ac728.netlify.app

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection  

    Detection Query 1 :

    domainname like "https://cred-agric.netlify.app" or url like "https://cred-agric.netlify.app" or siteurl like "https://cred-agric.netlify.app" or domainname like "https://secure-server-hub--no-replysignin.replit.app" or url like "https://secure-server-hub--no-replysignin.replit.app" or siteurl like "https://secure-server-hub--no-replysignin.replit.app" or domainname like "https://security-server-landing-page--009wq.replit.app" or url like "https://security-server-landing-page--009wq.replit.app" or siteurl like "https://security-server-landing-page--009wq.replit.app" or domainname like "https://square-coin-cloud.created.app" or url like "https://square-coin-cloud.created.app" or siteurl like "https://square-coin-cloud.created.app" or domainname like "https://seashell-owl-632549.hostingersite.com" or url like "https://seashell-owl-632549.hostingersite.com" or siteurl like "https://seashell-owl-632549.hostingersite.com" or domainname like "https://brazil-documento-brazil-documento.framer.ai" or url like "https://brazil-documento-brazil-documento.framer.ai" or siteurl like "https://brazil-documento-brazil-documento.framer.ai" or domainname like "https://credi-pc--jonfervera4.replit.app" or url like "https://credi-pc--jonfervera4.replit.app" or siteurl like "https://credi-pc--jonfervera4.replit.app" or domainname like "https://hh6515.craftum.io" or url like "https://hh6515.craftum.io" or siteurl like "https://hh6515.craftum.io" or domainname like "https://coenbase-pro-secure.created.app" or url like "https://coenbase-pro-secure.created.app" or siteurl like "https://coenbase-pro-secure.created.app" or domainname like "https://site-pearl-portal-23f1.surge.sh" or url like "https://site-pearl-portal-23f1.surge.sh" or siteurl like "https://site-pearl-portal-23f1.surge.sh"

    Detection Query 2 :

    domainname like "https://alltijjarieywaffabnnk.lovable.app" or url like "https://alltijjarieywaffabnnk.lovable.app" or siteurl like "https://alltijjarieywaffabnnk.lovable.app" or domainname like "https://attwebupdate4085j483hj392.framer.ai" or url like "https://attwebupdate4085j483hj392.framer.ai" or siteurl like "https://attwebupdate4085j483hj392.framer.ai" or domainname like "https://banknagar-info.netlify.app" or url like "https://banknagar-info.netlify.app" or siteurl like "https://banknagar-info.netlify.app" or domainname like "https://binance-support-pro.lovable.app" or url like "https://binance-support-pro.lovable.app" or siteurl like "https://binance-support-pro.lovable.app" or domainname like "https://bitkey-cloud-wallet.created.app" or url like "https://bitkey-cloud-wallet.created.app" or siteurl like "https://bitkey-cloud-wallet.created.app" or domainname like "https://bnidirectbnilogin.netlify.app" or url like "https://bnidirectbnilogin.netlify.app" or siteurl like "https://bnidirectbnilogin.netlify.app" or domainname like "https://bybit-logi-auth.created.app" or url like "https://bybit-logi-auth.created.app" or siteurl like "https://bybit-logi-auth.created.app" or domainname like "https://desenrola-aprovado.lovable.app" or url like "https://desenrola-aprovado.lovable.app" or siteurl like "https://desenrola-aprovado.lovable.app" or domainname like "https://frabjous-druid-8cf591.netlify.app" or url like "https://frabjous-druid-8cf591.netlify.app" or siteurl like "https://frabjous-druid-8cf591.netlify.app" or domainname like "https://freerobox2434w.netlify.app" or url like "https://freerobox2434w.netlify.app" or siteurl like "https://freerobox2434w.netlify.app" or domainname like "https://kucoin-home.created.app" or url like "https://kucoin-home.created.app" or siteurl like "https://kucoin-home.created.app" or domainname like "https://minimal-centered-car-23p0.bolt.host" or url like "https://minimal-centered-car-23p0.bolt.host" or siteurl like "https://minimal-centered-car-23p0.bolt.host" or domainname like "https://myjunoupdatenow.framer.website" or url like "https://myjunoupdatenow.framer.website" or siteurl like "https://myjunoupdatenow.framer.website" or domainname like "https://mytalktalkbroadbandteam.framer.website" or url like "https://mytalktalkbroadbandteam.framer.website" or siteurl like "https://mytalktalkbroadbandteam.framer.website" or domainname like "https://qill.netlify.app" or url like "https://qill.netlify.app" or siteurl like "https://qill.netlify.app" or domainname like "https://regal-specukam.netlify.app" or url like "https://regal-specukam.netlify.app" or siteurl like "https://regal-specukam.netlify.app" or domainname like "https://security-server-page--lizma150.replit.app" or url like "https://security-server-page--lizma150.replit.app" or siteurl like "https://security-server-page--lizma150.replit.app" or domainname like "https://security-server-page--mhamiltonhunter.replit.app" or url like "https://security-server-page--mhamiltonhunter.replit.app" or siteurl like "https://security-server-page--mhamiltonhunter.replit.app" or domainname like "https://shy84cy2cpklpedzwvshy84cy2cpklpedzwv-fidelty-com.replit.app" or url like "https://shy84cy2cpklpedzwvshy84cy2cpklpedzwv-fidelty-com.replit.app" or siteurl like "https://shy84cy2cpklpedzwvshy84cy2cpklpedzwv-fidelty-com.replit.app" or domainname like "https://subtle-belekoy-f2a734.netlify.app" or url like "https://subtle-belekoy-f2a734.netlify.app" or siteurl like "https://subtle-belekoy-f2a734.netlify.app" or domainname like "https://trust-guide-hero.lovable.app" or url like "https://trust-guide-hero.lovable.app" or siteurl like "https://trust-guide-hero.lovable.app" or domainname like "https://vinte-setup.bolt.host" or url like "https://vinte-setup.bolt.host" or siteurl like "https://vinte-setup.bolt.host" or domainname like "https://zoom-web3-longma-7ac728.netlify.app" or url like "https://zoom-web3-longma-7ac728.netlify.app" or siteurl like "https://zoom-web3-longma-7ac728.netlify.app" 

    Reference:    

    Phishing Pages Hosted on AI-based Site Builders                                                              


    Tags

    MalwareAIPhishing

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags