bafkreiciyarjb6ku4tv2theoujtif4mwj3ekqsep26qiqgypkjb3gmk35a[.]ipfs[.]dweb[.]link

The domain bafkreiciyarjb6ku.ipfs.dweb.link is identified as an active generic phishing threat specializing in credential harvesting under the guise of an email login portal. Analysis of the page title, EmailLogin, confirms the domain’s intent to deceive users into submitting sensitive authentication details. No specific brand impersonation is evident from the available data, though the generic login interface suggests broad targeting of email service credentials. The domain remains operational as of the latest verification. Infrastructure analysis reveals the domain is flagged by 15 of 95 security vendors on VirusTotal, indicating a high-confidence detection rate. It resolves to the IP address 209.94.90.2, hosted under AS40680 (Protocol Labs) in the United States. The domain was registered through CSC Corporate Domains, Inc. on February 24, 2017, though the phishing activity appears to be a recent deployment. It is currently listed on one security blocklist and is blocked by at least one anti-phishing service. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its accessibility. Current status confirms the domain is still active and operational, posing an ongoing risk to users. Organizations and individuals are advised to implement immediate countermeasures, including adding the domain and its resolving IP (209.94.90.2) to network-level blocklists. Endpoint protection systems should be updated to recognize the domain’s signatures, and users should be educated to scrutinize unsolicited login prompts, particularly those hosted on decentralized platforms like IPFS. Monitoring for credential leaks associated with this domain is recommended, as harvested data may be exploited in subsequent attacks.