php-web-server--univunitt[.]replit[.]app

The domain php-web-server--univunitt.replit.app is currently active and classified as a high‑risk generic phishing site. Registration data indicates that the domain was created through Replit Inc., a known cloud development platform, but the authoritative nameservers could not be resolved (NS_NOT_FOUND). Infrastructure analysis shows the domain resolves to the IP address 34.117.33.233, which is hosted on Replit's infrastructure.

Google Safe Browsing flags the domain for social engineering, confirming that it is being used to lure victims. VirusTotal reports that 12 of 91 security vendors have flagged the domain, providing independent confirmation of malicious intent. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing its status as a phishing vector.

While the exact payload or credential‑harvesting page has not been disclosed, the available evidence demonstrates a clear malicious profile. Defenders should block the domain at network perimeters, update DNS filtering policies to include the observed IP, and monitor for any outbound connections to the associated host. Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as SSL certificates, HTTP response codes, or page titles that are presently unavailable.