php-hello-world--w1tc3ve1ro[.]replit[.]app

This domain, php-hello-world--w1tc3ve1ro.replit.app, is a potentially malicious site currently offline. Based on its name, the site likely presented itself as a PHP-based "Hello World" application hosted on a Replit subdomain, but it posed a threat as a phishing or malware distribution platform. The site was flagged by multiple security vendors for malicious activity, indicating it was used to deceive visitors or deliver harmful payloads.

Technical evidence from VirusTotal shows the domain was flagged by 7 out of 95 vendors, including alphaMountain.ai, Cluster25, CRDF, Gridinsoft, and MalwareURL. It appears on 1 blocklist. The domain is registered with Nom-IQ Limited dba Com Laude, created on 2026-02-21, and resolves to IP address 34.117.33.233 in the United States, assigned to AS396982 Google LLC. SSL certificate is issued by Google Trust Services / WR3. Nameservers are from Google Cloud DNS.

The site is currently down or offline. With a DOM risk score of 63 and 7/95 VirusTotal detections, the risk level is elevated. The domain’s recent creation date and presence on blocklists suggest it was a short-lived, active threat that has since been taken offline.