bafkreicbdkvqb7e2flcg4wm6okkyijx5zmut7aamqxeq5s7kmr7syai5xa[.]ipfs[.]dweb[.]link

PhishDestroy has identified a brand impersonation threat targeting users of Generic Email services through the domain bafkreicbdkvqb7e2flcg4wm6okkyijx5zmut7aamqxeq5s7kmr7syai5xa.ipfs.dweb.link. This domain is currently offline but was actively used to mimic a Webmail Sign-in page, aiming to harvest login credentials from unsuspecting victims. The threat is classified as brand impersonation due to its deliberate replication of Generic Email's authentication interface.

Technical analysis reveals that the domain resolves to IP address 209.94.90.3 and is secured with a Let's Encrypt SSL certificate (E7). It was created on February 24, 2017, and registered through CSC Corporate Domains, Inc. VirusTotal data shows that 17 out of 95 security vendors flag this domain as malicious, and it appears on 2 security blocklists. These indicators confirm the domain's association with phishing activities, despite its current offline status.

Given that the domain is now offline, the immediate risk is mitigated; however, users should remain vigilant for similar IPFS-based phishing domains that may emerge. PhishDestroy recommends that organizations using Generic Email services implement multi-factor authentication and educate users about recognizing phishing attempts, especially those hosted on decentralized platforms like IPFS. Users who may have interacted with this domain should change their passwords immediately and monitor accounts for unauthorized access. Always verify the authenticity of login pages by checking the URL and using bookmarked links rather than clicking on unsolicited emails.