bafybeifhkli7dfi6brfwr3637krztfkps6yf26wqe45ks7mq23jkrg5pzm[.]ipfs[.]dweb[.]link

PhishDestroy identifies an active credential-phishing campaign hosted at the IPFS gateway domain bafybeifhkli7dfi6brfwr3637krztfkps6yf26wqe45ks7mq23jkrg5pzm.ipfs.dweb.link. The page masquerades as a login portal to harvest user names and passwords for multiple email and cloud services. Traffic is routed through IP address 209.94.90.2, a hosting range previously associated with malware and botnet activity. This domain was flagged by 16 out of 95 VirusTotal security vendors, indicating elevated risk without immediate consensus on the exact payload. It was registered on February 24, 2017 via CSC Corporate Domains, Inc., and secured with a Let’s Encrypt SSL certificate to appear legitimate. The long registration period suggests possible domain aging for evasion rather than recent malicious acquisition. Users who visited this page should immediately change any credentials entered, enable multi-factor authentication on linked accounts, and scan local devices with up-to-date antivirus software. If no credentials were submitted, clear browser cache and cookies for the site then block the domain at the network firewall. Report the incident to your security team and to PhishDestroy with the unique seed 14c0aa for further threat hunting.