901c705a-7072-40b9-b144-7e9b73aca18e-00-37vacz5fs42ob[.]riker[.]replit[.]dev

The site presents a deceptive landing page stating "The app is currently not running. Deploy this app to keep it running externally," which is a generic placeholder used by the Replit development platform. This domain does not host a legitimate application but appears to be an inactive or abandoned Replit project. The threat posed is that such domains, even when offline, can be weaponized for phishing campaigns, malware distribution, or credential harvesting if reactivated, as they may be used to host malicious content under the guise of a legitimate development environment.

Technical evidence reveals significant security concerns. VirusTotal flags the domain with 14 out of 95 detections, indicating a high level of suspicion among security vendors. Specific flagging vendors include ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, and CyRadar. The domain is listed on 2 blocklists. The IP address is 34.173.153.191, located in the United States and hosted by AS396982 Google LLC. The domain is registered through Replit Inc., with nameservers ns.replit.com. SSL certificate is issued by Let's Encrypt (R13). No creation date is provided in the available data.

The site is currently offline or down. Risk level is high, as indicated by the ScamAdviser trust score of 1 out of 100 and the 14/95 VirusTotal detection rate. Despite being offline, the domain remains registered and could be reactivated to serve malicious content, warranting continued monitoring and blocking.