encryptedporfoliodocuments[.]replit[.]app

The domain encryptedporfoliodocuments.replit.app is currently classified as a credential phishing site and remains active as of the report date, July 22, 2026. Infrastructure analysis shows the domain resolves to the IPv4 address 34.117.33.233, which is allocated to Google LLC under ASN 396982 and geolocated in the United States. The hosting provider is Replit, as indicated by the registrar information. An SSL certificate issued by Google Trust Services (CN=WR3) is present, confirming that Transport Layer Security is employed, but the certificate does not mitigate the malicious intent.

HTTP response code 200 is returned, and the only observed page title is "Please wait," suggesting a possible redirect or loading stage. Detection engines on VirusTotal have flagged the domain, with 11 of 91 security vendors marking it as malicious. The independent Gridinsoft trust score is 0 out of 100, reinforcing the low trust assessment. The domain appears on a single external blocklist and is actively blocked by PhishDestroy, indicating that at least one threat‑intelligence feed is recognizing the operation.

No nameserver records were retrieved (NS_NOT_FOUND), which may hinder automated DNS‑based detection. Defenders should add the hostname and its resolved IP address to inbound and outbound filtering rules, enforce DNS sinkholing where possible, and monitor for any authentication attempts to corporate services originating from this endpoint. Continuous telemetry collection from web proxy and endpoint logs is advised to capture any attempted credential submissions. Given the confirmed vendor detections, low trust score, and active blocklist status, the domain should be treated as high‑risk and blocked across all security controls pending further investigation.