bafkreie45gvjpqk3q3qfguediyj6tvyz2azroerva3hzsohajh47zn4jkm[.]ipfs[.]dweb[.]link

The domain bafkreie45gvjpqk3q3qfguediyj6tvyz2azroerva3hzsohajh47zn4jkm.ipfs.dweb.link is identified as a brand impersonation threat, specifically targeting Generic Email. The domain impersonates a legitimate webmail service, Roundcube Webmail, to deceive users into providing sensitive information.

Infrastructure analysis reveals that the domain is registered through CSC Corporate Domains, Inc. and resolves to the IP address 209.94.90.3, located in the United States (US) under the Autonomous System AS40680 Protocol Labs. The domain was created on February 24, 2017, and the SSL certificate is issued by Let's Encrypt with the serial number E7. The domain is currently listed on 2 security blocklists, and VirusTotal reports that 22 out of 95 security vendors flag this domain as malicious.

The domain is currently offline, which reduces the immediate risk to potential victims. However, the infrastructure remains in place, and the domain could be reactivated at any time. Organizations and individuals should ensure that their security policies and email filters are updated to block this domain. Network administrators should also monitor for any attempts to access this domain and educate users on the dangers of brand impersonation attacks.