dd5cea65-8789-4278-9de6-38e02b38d22d-00-8on25l5vyms5[.]riker[.]replit[.]dev

This domain, dd5cea65-8789-4278-9de6-38e02b38d22d-00-8on25l5vyms5.riker.replit.dev, poses a specific threat as a generic phishing platform designed to harvest user credentials or sensitive information through deceptive login pages or form submissions. The domain's structure, hosted on Replit and using Let's Encrypt SSL, suggests it was rapidly deployed for malicious campaigns targeting unsuspecting visitors.

Evidence from PhishDestroy's investigation shows that 21 out of 95 security vendors on VirusTotal flagged this domain as malicious, indicating broad recognition of its phishing nature. Registered through NameCheap, Inc. on February 21, 2026, the domain appears on one security blocklist and has since been taken offline, though its IP address 34.173.153.191 remains associated with the threat. The page title 'Hmm... We couldn't reach this app' suggests the phishing site was already disabled, but the domain's recent creation and high detection rate confirm its intent.

Users who visited this domain should immediately change any passwords or credentials entered into the site, monitor financial accounts for unusual activity, and run a full antivirus scan on their devices. PhishDestroy recommends reporting any phishing attempts to relevant authorities and enabling multi-factor authentication on all accounts to mitigate future risks. If sensitive data was shared, consider contacting your financial institution or identity theft protection services.