webmail-editor--webmail-in[.]replit[.]app

Analysis conducted on August 06, 2026 identifies webmail-editor--webmail-in.replit.app as an active phishing domain targeting webmail credentials. The domain is hosted on Replit Inc.'s infrastructure and currently resolves to the IP address 34.117.33.233, which is associated with cloud-based hosting services. Infrastructure analysis reveals the domain lacks configured nameservers, a common characteristic in hastily deployed phishing campaigns where operational security is minimal. VirusTotal telemetry indicates that 14 out of 91 security vendors have flagged this domain as malicious, providing a detection ratio that aligns with confirmed phishing activity. The domain appears on at least one security blocklist, further corroborating its classification as a threat.

PhishDestroy has implemented blocking measures, though the domain remains accessible at the time of this report. The registrar of record is Replit Inc., a platform commonly used for legitimate development but also exploited for short-lived phishing operations due to its free-tier hosting and subdomain capabilities. No SSL certificate details or HTTP response data were provided in the available intelligence, leaving the exact content of the phishing page unconfirmed. However, the domain name—containing the terms 'webmail' and 'editor'—strongly suggests an intent to harvest email credentials, a frequent target of credential phishing campaigns.

Defenders are advised to treat this domain as high-risk and implement blocking at the network and endpoint levels. Given the domain's active status and detection by multiple security vendors, organizations should monitor for connections to 34.117.33.233 and the domain itself in logs, particularly those related to webmail access attempts. Additional analysis of the phishing kit, if recoverable, may provide further indicators of compromise, though such investigation was not conducted as part of this assessment.