bafybeiaynlkvzpw5c3tfhkh7hq5wsqbfce7cvue6wfpa2nozxon5fbdfru[.]ipfs[.]dweb[.]link

This domain, identified by the unique seed c9d9b3, operates as a generic phishing site targeting Webmail credentials. Analysis indicates the page title is explicitly set to 'Webmail,' suggesting an attempt to impersonate legitimate email login portals. No specific brand or drainer kit signatures were identified, though the use of a generic Webmail theme aligns with common credential harvesting tactics. The domain leverages IPFS (InterPlanetary File System) via the dweb.link gateway, a technique increasingly observed in phishing campaigns to evade traditional takedown mechanisms. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 17 out of 95 security vendors on VirusTotal, resolves to the IP address 209.94.90.2 (AS40680, Protocol Labs, US), and was registered through CSC Corporate Domains, Inc. on November 29, 2021. The SSL certificate is issued by Let's Encrypt (serial number E7), a detail that may aid in fingerprinting related infrastructure. The domain appears on one security blocklist and is currently blocked by at least one anti-phishing system. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. As of the latest assessment, the domain has been taken offline, likely due to remediation efforts by the hosting provider or gateway operator. However, the underlying IPFS content hash (bafybeiaynlkvzpw5c3tfhkh7hq5wsqbfce7cvue6wfpa2nozxon5fbdfru) may remain accessible via alternative gateways or direct IPFS access, posing a residual risk. Organizations are advised to monitor for re-emergence of this content hash or similar Webmail-themed phishing artifacts. Network-level blocking of the resolved IP (209.94.90.2) and inspection of Let's Encrypt certificates with serial E7 are recommended for proactive defense.