php-web-server--zurdacovas[.]replit[.]app

Analysis of php-web-server--zurdacovas.replit.app shows a newly observed phishing infrastructure hosted on Replit Inc. The domain resolves to the IPv4 address 34.117.33.233 and lacks publicly visible nameserver records. VirusTotal reports six detections out of ninety‑five scanners, indicating that multiple security vendors have identified malicious characteristics. The domain is listed on two public blocklists and is already blocked by PhishDestroy and OpenPhish, confirming its active status as of the report date, July 20, 2026. No additional intelligence about the targeted brand, page content, or credential‑harvesting mechanisms is available; the specific entity being impersonated remains unknown. Defenders should immediately add the domain and its resolving IP to network‑level blocklists, enforce DNS filtering with the listed blocklists, and monitor outbound connections for any attempts to reach 34.117.33.233. Continuous re‑evaluation is advised to capture any future changes in hosting or detection signatures.