indexzip-matthieuhug[.]replit[.]app

Analysis performed on July 26, 2026 indicates that the domain indexzip-matthieuhug.replit.app is currently active and resolves to the IPv4 address 34.117.33.233. The domain is registered through Replit Inc., a legitimate cloud development platform, but the registrar information does not provide any protective controls. DNS queries for the domain return no nameserver records, which aligns with the NS_NOT_FOUND flag in the intelligence feed. The host IP belongs to the Amazon Web Services infrastructure, a common hosting environment for both legitimate services and malicious actors. No SSL/TLS certificate details are available, and an HTTP status code was not captured during the scan, leaving the transport security posture unknown.

Multiple open‑source and commercial threat‑intelligence sources have flagged the domain. PhishDestroy and OpenPhish have independently added it to their phishing blocklists, confirming that it is being used for credential‑harvesting or other deceptive activities. VirusTotal reports that 18 of 91 scanned security vendors have positively identified the domain as malicious, providing a moderate consensus of danger across the scanning ecosystem. The domain also appears on two additional security blocklists, reinforcing the assessment that it should be treated as hostile.

Because the site is hosted on a shared cloud provider, the same IP address may serve unrelated benign tenants; however, the correlation of the IP with known phishing listings and the absence of legitimate reputation signals justify immediate mitigation. Defenders are advised to block DNS resolution for indexzip-matthieuhug.replit.app at the network perimeter, add the IP 34.117.33.233 to any relevant deny lists, and monitor for any outbound connections to that address. Continuous re‑query of public blocklists such as PhishDestroy, OpenPhish, and VirusTotal is recommended to capture any changes in classification.