1e16831b-e8c0-4fcc-be7d-abde0a24c834-00-8wehzac0phfm[.]riker[.]replit[.]dev

This domain is flagged as an elevated-risk brand impersonation threat targeting PayPal users through credential harvesting infrastructure. Analysis indicates the site was designed to mimic the official PayPal login portal, as evidenced by the page title 'Log in to your PayPal account' and its inclusion on two security blocklists specializing in phishing detection. Infrastructure analysis reveals the domain resolves to IP address 34.173.153.191, hosted on AS396982 (Google LLC) with a US-based geolocation. The domain was registered through Replit Inc. and is currently offline, though it remains detectable by 18 out of 95 security vendors on VirusTotal. It appears on PhishDestroy and PhishingDB blocklists, and its SSL certificate was issued by Let's Encrypt (R13). No creation date is available, but the unique seed 865192 confirms its distinct tracking in threat intelligence systems. Mitigation requires immediate action from security teams and end users. Network-level blocking should be implemented for the domain and its resolving IP (34.173.153.191) across firewalls, proxies, and email security gateways. Organizations should update their endpoint protection rules to flag any attempt to access this domain or its associated infrastructure. Users who may have interacted with the site should be instructed to reset PayPal credentials from a verified device, enable multi-factor authentication, and review recent account activity for unauthorized transactions. Security teams should monitor for related domains registered through Replit or hosted on Google Cloud infrastructure, as threat actors frequently reuse hosting providers for subsequent campaigns.