flow-open-7ff0[.]p-ygj98iy2[.]workers[.]dev

PhishDestroy identifies flow-open-7ff0.p-ygj98iy2.workers.dev as a high-risk credential theft phishing domain actively harvesting user login details. This Workers.dev subdomain mimics legitimate cloud services to deceive visitors into entering sensitive credentials. The page loads dynamically with no initial content, delaying red flags until input prompts appear.

This domain was flagged by multiple independent sources, with 10 out of 95 VirusTotal security vendors detecting malicious activity as of the latest scan. The domain resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc. It has been blocked by OpenPhish, appears on one active security blocklist, and holds a Let's Encrypt SSL certificate for added legitimacy. The Workers.dev infrastructure further complicates takedown efforts due to shared cloud hosting environments.

To mitigate credential theft risks, avoid entering any login credentials on this domain. Users should verify URLs directly via official channels, use password managers that warn about mismatched sites, and report any accidental submissions to affected service providers immediately. Network administrators are advised to block traffic to IP 188.114.96.3 and the domain at DNS/gateway levels.