document-sign-online--xfinityweb[.]replit[.]app

The domain document-sign-online--xfinityweb.replit.app is actively used in a credential‑harvesting campaign and remains live as of the report date, August 06, 2026. Registration information shows the domain was created through Replit Inc., a platform that provides hosting and development environments. Infrastructure analysis reveals that the domain resolves to the IP address 34.117.33.233, which is consistent with Replit’s public hosting range. The domain’s authoritative name server data is unavailable (NS_NOT_FOUND), indicating either a misconfiguration or deliberate concealment of DNS details.

Threat intelligence sources have applied mitigations: the domain is listed on one security blocklist and has been blocked by the PhishDestroy service, confirming that at least one protective feed has recognized the malicious activity. VirusTotal scans show that 15 out of 91 security vendors flagged the domain, providing independent corroboration of its malicious nature. No additional data such as Safe Browsing status, SSL certificate details, HTTP response codes, or page title have been disclosed, leaving the exact content and delivery mechanisms unverified.

Defenders should prioritize immediate blocking of the domain at network perimeter and DNS filtering layers, incorporate the associated IP address into host‑based deny lists, and monitor outbound connections for traffic to 34.117.33.233. Continuous observation of the domain’s status on blocklists and future VirusTotal scans is recommended to gauge any changes in detection coverage. Organizations using URL filtering should ensure that the domain is added to their threat feed updates, and incident response teams should be alerted to potential credential‑theft attempts that reference this domain, especially where users are directed to upload or sign documents online.