flow-share-qlpw[.]inbox-share[.]workers[.]dev

This domain operates as a generic phishing portal designed to harvest user credentials through fake login interfaces. Analysis indicates the site mimics legitimate authentication pages, tricking visitors into entering sensitive information such as usernames, passwords, or session tokens. The threat extends to potential follow-up attacks, including account takeovers or lateral movement within compromised networks. Infrastructure analysis reveals the domain was registered on April 28, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.67.168.147, geolocated in Canada. It appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Let's Encrypt (serial number E7), provides encrypted connections but does not mitigate the underlying malicious intent. The page title 'Loading...' suggests dynamic content delivery, likely tailored to evade detection or adapt to targeted victims. Users who accessed this domain should immediately terminate any active sessions and avoid entering credentials. Clear browser cache, cookies, and saved passwords associated with the site. If login details were submitted, reset passwords for all potentially affected accounts, enable multi-factor authentication where available, and monitor for unauthorized activity. Network administrators should block the domain and IP address at the perimeter to prevent further exposure.