bafkreiak6rgnyp5ck6773bzh327hyjmfcbs7i6t6ihj35zuz2vljnyuh54[.]ipfs[.]dweb[.]link

This domain, bafkreiak6rgnyp5ck6773bzh327hyjmfcbs7i6t6ihj35zuz2vljnyuh54.ipfs.dweb.link, operates as a credential theft phishing infrastructure targeting users through an EmailLogin interface. Analysis indicates the site mimics email authentication portals to harvest login credentials, though no specific brand impersonation or crypto drainer kit signatures have been confirmed. The page title EmailLogin suggests a focus on generic email service credential collection, a common tactic for account compromise and subsequent lateral movement in compromised environments. Infrastructure analysis reveals the domain resolves to IP address 209.94.90.2 and is secured with a Let's Encrypt SSL certificate. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc. Security vendor detection on VirusTotal stands at 17/95, indicating moderate but not universal recognition of the threat. No Google Safe Browsing (GSB) listing was identified in the current dataset, though the absence of GSB flags does not preclude malicious activity. Additional blocklist monitoring shows the domain remains active across multiple threat intelligence feeds, with no evidence of takedown or sinkholing. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing emails, malicious redirects, or compromised web advertisements. Recommended response actions include blocking the domain and associated IP at the network perimeter, implementing browser-based warnings for users, and monitoring for credential reuse in enterprise environments. The risk level is classified as high due to the domain's persistence, active credential harvesting functionality, and partial but incomplete coverage by security vendors. Organizations should treat this infrastructure as a live threat and prioritize user education on recognizing email login fraud attempts.