doc-sign-online--microsoftlogs[.]replit[.]app

Analysis indicates that the domain doc-sign-online--microsoftlogs.replit.app is currently active and resolves to the IPv4 address 34.117.33.233. Registration information shows the domain was created through Replit Inc., a reputable development platform that also provides the hosting environment. The domain lacks publicly resolvable nameserver records, as the nameserver lookup returned NS_NOT_FOUND, which may hinder typical DNS‑based reputation checks. VirusTotal has recorded 16 of 91 security vendors flagging the domain, indicating a moderate level of consensus among scanning engines that the site is malicious.

Independent blocklist monitoring confirms that the domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service. No additional public reputation services such as Safe Browsing or OTX are referenced in the supplied intelligence. The limited detection footprint, combined with the presence on a known phishing blocklist, suggests that the infrastructure is being used for a generic phishing campaign targeting users who may be enticed to submit credentials.

Defenders should add the domain and its resolved IP address to outbound and inbound deny lists, enforce DNS filtering that drops queries for the domain, and monitor network traffic for connections to 34.117.33.233. Continuous re‑evaluation is advised, as the threat actor may modify hosting or rename the domain in future iterations. Until further forensic analysis of the hosted content is performed, the domain should be treated as high‑risk.