quiet[.]rwks332[.]workers[.]dev

This domain, quiet.rwks322.workers.dev, is actively engaged in credential harvesting operations targeting users through phishing campaigns. Analysis indicates the site mimics legitimate login portals to capture sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication tokens. The infrastructure is designed to evade detection through short-lived deployments and the use of content delivery networks to obscure its true origin. Evidence supporting this assessment includes detection by 13 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. The domain was registered through Cloudflare Workers on April 17, 2026, and remains operational despite its malicious intent. It resolves to the IP address 172.67.212.105, associated with Cloudflare’s infrastructure in Canada, and employs a Google Trust Services SSL certificate (WE1) to lend an appearance of legitimacy. Users who have interacted with quiet.rwks322.workers.dev should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. It is recommended to reset passwords for all accounts where the same credentials may have been reused. Additionally, affected users should enable multi-factor authentication where available and review recent login activity for signs of compromise. Network administrators are advised to block the domain and its resolving IP address at the perimeter to prevent further exposure.