view-doc-g5mz[.]sandyroby1985[.]workers[.]dev

PhishDestroy identifies view-doc-g5mz.sandyroby1985.workers.dev as an active Dropbox-branded phishing page designed to harvest Microsoft 365 or other enterprise login credentials. The domain presents a fake document viewer that requests a password under the pretext of accessing a shared file, tricking users into surrendering sensitive authentication data. The page is currently served from a Cloudflare Workers subdomain and has already been blocked by the OpenPhish feed, but its Google-issued SSL certificate and residential IP 104.21.34.163 give it an air of legitimacy that can evade quick user scrutiny. This domain was flagged after VirusTotal scans returned 0 detections out of 95 engines at discovery. Passive DNS evidence suggests the subdomain appeared within the last 48 hours, and it is registered through Cloudflare, Inc., the same provider exploited in numerous recent campaign spikes. While the landing page content varies, it consistently impersonates a document-sharing workflow, and sandbox analysis shows attempted credential exfiltration to a remote endpoint encoded in the URL parameters. If you have visited view-doc-g5mz.sandyroby1985.workers.dev, disconnect from the network immediately, revoke any passwords entered on the page, and run a full antivirus scan. Report the incident to your IT team and delete or flag the domain in your browser and DNS filters. Monitor accounts for unusual activity for at least 30 days, and enable multi-factor authentication wherever possible so that stolen credentials alone cannot grant access.