bafkreicqh5ym5wvmfmtqbhltcawz4soxzag5xxusf7rvbtwdz4lrnttrsi[.]ipfs[.]dweb[.]link

PhishDestroy identifies a persistent credential-theft landing page hosted on IPFS under the path bafkreicqh5ym5wvmfmtqbhltcawz4soxzag5xxusf7rvbtwdz4lrnttrsi.ipfs.dweb.link. The page poses as an EmailLogin portal, tricking users into surrendering mailbox credentials. No overt brand impersonation or drainer kit artifacts are visible in the available sample, but the page title and lure clearly target email account takeover. Access vectors include the IPFS gateway, suggesting potential evasion via decentralized hosting while maintaining a classic phishing front end.

Technical indicators confirm high risk: VirusTotal flags reached 22 out of 95 engines; the domain resolves to 209.94.90.2; registration occurred on February 24, 2017 via CSC Corporate Domains, Inc.; and the certificate is issued by Let’s Encrypt. The page has been blocked by OpenPhish and OISD and is absent from Google Safe Browsing at the time of analysis. Its longevity since 2017 further underscores its use in long-running campaigns rather than short-lived disposable domains.

Current status remains ACTIVE despite dual blocklist coverage; the domain continues to resolve and serve the phishing template. Organisations should block the IP 209.94.90.2 and the full IPFS CID path via DNS, firewall, and proxy rules. Users should treat any unsolicited EmailLogin prompts as suspicious and verify using out-of-band channels. Given the 23% detection rate on VirusTotal and continued accessibility, residual risk remains HIGH until widespread enforcement actions are applied.