bafybeif2v4tzjfkmfxuxylhezpqrwrptfkfu3tshsyvk2te4rle62kjjwu[.]ipfs[.]dweb[.]link

This domain, bafybeif2v4tzjfkmfxuxylhezpqrwrptfkfu3tshsyvk2te4rle62kjjwu.ipfs.dweb.link, is identified as a generic phishing site targeting Webmail credentials. Analysis of the page title and content structure indicates an attempt to impersonate legitimate Webmail login portals, likely designed to harvest user credentials through fraudulent input forms. No specific brand logo or proprietary drainer kit signatures were detected, but the generic Webmail theme aligns with common credential phishing tactics observed in distributed web environments. Technical indicators confirm elevated risk: the domain is flagged by 21 out of 95 security vendors on VirusTotal, registered through CSC Corporate Domains, Inc., and resolves to IP address 209.94.90.2 hosted on AS40680 (Protocol Labs). The domain was created on March 01, 2026, and currently appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while valid, does not mitigate the malicious intent of the content served. Google Safe Browsing status is not explicitly listed, but the presence on a single blocklist and VirusTotal detection rate suggest active malicious classification. The domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains potentially reusable, and the IP address may still host other malicious content. Users who accessed the domain prior to takedown should assume credential compromise and initiate password resets on all associated accounts. Organizations are advised to block the domain and IP at the perimeter, monitor for related IOCs, and review logs for connections to 209.94.90.2 or the domain's unique identifier bafybeif2v4tzjfkmfxuxylhezpqrwrptfkfu3tshsyvk2te4rle62kjjwu. The registrar and hosting provider should be notified of abuse to prevent further misuse of the infrastructure.