bafkreidkah5u3loryz2bzvfwqrp6y42ki4q4w7y7n6dz3vtp4prz66wtyi[.]ipfs[.]dweb[.]link

This domain, bafkreidkah5u3loryz2.ipfs.dweb.link, is identified as a credential theft phishing site designed to harvest user login credentials through a deceptive EmailLogin interface. The page mimics legitimate email login portals to trick visitors into submitting sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. Credential theft of this nature is commonly used to gain unauthorized access to personal or corporate accounts, leading to data breaches, financial fraud, or further exploitation through lateral movement in compromised networks. Analysis indicates the domain was registered on April 26, 2026, through CSC Corporate Domains, Inc., and is hosted on infrastructure associated with Protocol Labs in the United States, resolving to IP address 209.94.90.2. The site is flagged by 21 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt, a common tactic used to lend an appearance of legitimacy to malicious sites. The domain's current offline status suggests takedown action, but similar threats may re-emerge under different identifiers. If you visited this domain or entered credentials on the EmailLogin page, immediate action is required. First, change passwords for any accounts accessed from the same device or network, prioritizing email, financial, and work-related services. Enable multi-factor authentication where available to add an additional layer of security. Scan the device used to access the site for malware or unauthorized access tools, as credential theft sites often deploy secondary payloads. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective service providers. If corporate credentials were exposed, notify your organization's security team to assess potential risks to internal systems.