core-flow-0np5[.]pdfonlinedocsdocs-outlook-com-s-account[.]workers[.]dev

PhishDestroy identifies core-flow-0np5.pdfonlinedocsdocs-outlook-com-s-account.workers.dev as a high-risk Microsoft impersonation domain actively distributing a OneDrive phishing scam. The fraudulent page mimics Microsoft’s official login interface to harvest user credentials, deploying a classic credential theft attack vector. This domain was flagged by Phishunt and OpenPhish, two independent security blocklists, confirming its malicious intent. The site resolves to IP address 188.114.96.3 and operates under a valid Let’s Encrypt SSL certificate to appear legitimate.

This domain poses an immediate threat due to its sophisticated impersonation tactics targeting Microsoft 365 users. Evidence of its malicious nature includes VirusTotal detection by 7 of 95 security vendors, registration via Cloudflare, Inc., and active status despite blocklist interventions. The use of Workers.dev infrastructure by Cloudflare enables rapid deployment and evasion of traditional takedown methods, making this campaign particularly persistent. PhishDestroy analysis confirms the page title ‘Loading...’ is a temporary placeholder, often replaced by a spoofed Microsoft login portal once the page fully loads.

Users who visited this domain should immediately assess whether any credentials were entered into the fraudulent form. If credentials were submitted, change passwords immediately and enable multi-factor authentication (MFA) on all linked Microsoft accounts. Run a full system scan using an up-to-date antivirus solution to detect any potential malware delivered through the site. Report the incident to Microsoft via their official phishing reporting portal (https://support.microsoft.com/en-us/report/phishing) and consider revoking any saved sessions or tokens. Always verify domains and URLs before entering sensitive information, especially when redirected through unsolicited links or email attachments.