bafkreiaxnzikanpc2w5ysusp4g7dt2ec3prfnd6e6vo2lpebnmn4767n4y[.]ipfs[.]dweb[.]link

This domain is flagged for hosting a brand impersonation campaign targeting Outlook Web Access users. The site mimics the legitimate Outlook Web App login interface, designed to harvest corporate credentials by deceiving users into entering their login details. Infrastructure analysis reveals the page title as 'Outlook Web App,' a clear indicator of intent to impersonate Microsoft's email service for credential theft purposes.

Analysis indicates the domain was registered on November 29, 2021, through CSC Corporate Domains, Inc. It resolves to the IP address 209.94.90.3, located in the United States under AS40680 (Protocol Labs). The SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its accessibility. Detection metrics show 23 out of 95 security vendors on VirusTotal have flagged this domain, while it also appears on one security blocklist. These indicators collectively confirm the elevated risk level associated with this threat.

Users who visited this domain should immediately change their Outlook or Microsoft 365 credentials from a secure device. Enable multi-factor authentication (MFA) if not already active, as this adds an additional layer of security against unauthorized access. Monitor accounts for suspicious activity, such as unauthorized login attempts or unfamiliar sent emails. If corporate credentials were entered, notify the organization's IT or security team to initiate an internal investigation and mitigate potential risks.