bafkreibupiq2fnvqdhui556opdnhkidbtrdapw46ytd5eis7vqfotuc72y[.]ipfs[.]dweb[.]link

This domain represents a credential-harvesting phishing operation specifically targeting webmail authentication portals. Analysis of the infrastructure reveals a fraudulent Webmail Sign-in page designed to capture user credentials through social engineering tactics. The threat actor appears focused on email account compromise, which could enable subsequent business email compromise attacks, data exfiltration, or lateral movement within organizational networks. Infrastructure analysis provides concrete evidence of malicious intent. The domain was registered through CSC Corporate Domains, Inc. on March 03, 2026, with detection metrics showing 20 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on two independent security blocklists, indicating cross-industry recognition of the threat. Technical indicators include resolution to IP address 209.94.90.3 (AS40680 Protocol Labs) and use of Let's Encrypt E7 SSL certificate, suggesting attempts to appear legitimate while maintaining operational security. Users who visited this domain should immediately take corrective action. Any credentials entered on the Webmail Sign-in page should be considered compromised and changed from a separate, secure device. Organizations should review authentication logs for the affected accounts, particularly looking for anomalous login attempts or geographic inconsistencies. The domain's current offline status does not eliminate risk, as harvested credentials may be stored for future exploitation. Security teams should add the IP address 209.94.90.3 and associated domain patterns to monitoring systems for internal detection capabilities.