2fde2a4e-8d44-468f-a14a-a457f48b85d0-00-1lmdm2yz6liz2[.]janeway[.]replit[.]dev

The domain 2fde2a4e-8d44-468f-a14a-a457f48b85d0-00-1lmdm2yz6liz2.janeway.replit.dev was registered on February 21, 2026 through NameCheap, Inc. Technical fingerprinting shows the site is hosted on the Replit platform and serves HTTP responses with a 404 status code. The page title returned by the server is "Run this app to see the results here," which offers no indication of a legitimate service and is consistent with a placeholder page often used in malicious deployments. Security telemetry indicates that twelve of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. The domain is currently listed as offline and has been blocked by the PhishDestroy sinkhole, confirming that active mitigation has been applied.

Analysis of the available data suggests the infrastructure is being used for a generic phishing campaign, likely leveraging the Replit hosting environment to obscure the true origin of the traffic. The presence of HTTP Strict Transport Security (HSTS) indicates that HTTPS was enforced, but the 404 response prevents content inspection. No additional intelligence such as IP geolocation, ASN, or associated malware kits is available, leaving the broader threat actor profile uncertain.

Defenders should continue to monitor for any resurgence of the domain or related subdomains, enforce blocklist rules in network security appliances, and consider adding the domain to internal deny lists. Given the VirusTotal detection rate and the confirmation from PhishDestroy, it is prudent to treat any emails or messages referencing this domain as malicious. Ongoing collection of DNS query logs and TLS handshake data may reveal further infrastructure components if the campaign reactivates.