m-repo[.]up[.]railway[.]app

The domain m-repo.up.railway.app is currently active and utilized for phishing activities, specifically targeting users with a fake code compiler interface. Despite being flagged by PhishDestroy, MetaMask, and SEAL, it remains undetected by major antivirus vendors, with 0 out of 91 VirusTotal detections. This indicates its freshness and highlights the 24-72 hour gap between domain registration and antivirus database updates, during which phishing domains can operate unnoticed.

Registered under an unknown registrar and hosted on IP 69.46.46.48 in the United States, the domain leverages Let's Encrypt for SSL certification. The hosting organization, Railway, is associated with ASN AS400940. The platform risk score of 75 out of 100 underscores the potential threat level posed by this domain. The presence of a public blocklist entry by MetaMask suggests a possible targeting of cryptocurrency users.

PhishDestroy's early detection of m-repo.up.railway.app on June 22, 2026, underscores the importance of upstream threat intelligence in identifying and mitigating risks before they propagate through traditional antivirus channels. As phishing tactics become increasingly sophisticated, early identification and intervention are crucial in protecting users from potential data breaches and financial loss. This case exemplifies the need for continuous monitoring and rapid response to emerging threats in the digital landscape.