doc-edge-pzau[.]inbox-share[.]workers[.]dev

This domain, doc-edge-pzau.inbox-share.workers.dev, is flagged as an active credential harvesting site targeting users through deceptive login interfaces. Analysis indicates no direct brand impersonation, suggesting a generic phishing framework likely leveraging a lightweight drainer kit or pre-built phishing page template. The domain exhibits characteristics typical of credential theft operations, including minimal page content (displaying only 'Loading...') to evade initial detection while awaiting victim interaction. Infrastructure analysis reveals concrete technical indicators: the domain resolves to IP 172.67.168.147, hosted on Cloudflare infrastructure with a Let's Encrypt SSL certificate (serial E7). Registered through Cloudflare, Inc. on May 02, 2026, the domain is currently detected by 16 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is actively blocked by enterprise phishing detection systems. The creation date discrepancy (2026) suggests either a typo in registration records or intentional manipulation to evade temporal-based detection rules. The domain remains operational despite detection, indicating persistent threat actor activity. Response actions should include immediate blocking of the domain and IP at network perimeter levels, along with monitoring for related subdomains or sister domains under the inbox-share.workers.dev namespace. Remaining risk includes potential credential exposure for users who interacted with the site before detection, as well as possible lateral movement within compromised networks. Organizations are advised to review authentication logs for connections to this domain and implement multi-factor authentication for all external-facing services to mitigate credential theft impact.