rwlha-qilv-ic1v[.]p-rrw76os2[.]workers[.]dev

PhishDestroy identifies rwlha-qilv-ic1v.p-rrw76os2.workers.dev as an active credential-phishing site that mimics a Microsoft 365 login page to steal usernames and passwords. The domain uses Cloudflare Workers to host the fake portal, making it harder to block at the network layer while evading traditional URL filters. Traffic is routed through Cloudflare’s edge (IP 172.67.214.59) and secured with a Let’s Encrypt certificate, giving the impostor site a deceptive padlock icon. This domain was flagged as malicious by exactly four VirusTotal security vendors out of 95 checked, indicating it has just begun to be recognized as a threat. It was registered through Cloudflare, Inc. and immediately provisioned on Cloudflare Workers, a pattern consistent with fast-flux phishing campaigns that live only hours before being shut down and replaced. Do not enter any credentials on this page. If you already visited and typed your Microsoft 365 username and password, change the password immediately and enable multi-factor authentication. Report the incident to your IT help desk and scan your device with up-to-date antivirus software. Avoid clicking any links received via email or text; instead navigate directly to the official portal and verify the URL uses microsoftonline.com before signing in.