bafkreiduyw74tukcsbnx6qrmjolyk53f5smk3wvexijffc2wr25m6fucme[.]ipfs[.]dweb[.]link

The domain bafkreiduyw74tukcsbnx6qrmjolyk53f5smk3wvexijffc2wr25m6fucme.ipfs.dweb.link was identified as a generic phishing threat, with the page title 'EmailLogin' indicating it likely targets email credentials. No specific brand or drainer kit was associated with this domain, but its design suggests a credential harvesting attack aimed at unsuspecting users.

Technical indicators paint a clear picture of risk: VirusTotal flagged this domain with a score of 21 out of 95 security vendors, indicating widespread detection. The domain was registered through CSC Corporate Domains, Inc., and resolves to IP address 209.94.90.3. Created on April 25, 2026, it appears on 1 security blocklist and has an SSL certificate issued by Let's Encrypt (E8). Notably, Google Safe Browsing (GSB) status was not explicitly provided, but the blocklist inclusion raises further concern.

As of the latest analysis, the domain has been taken offline, effectively neutralizing the immediate threat. Response actions include blocking the domain and IP at network perimeters and monitoring for related infrastructure. However, users who may have already interacted with the site should change their email passwords and enable multi-factor authentication. The remaining risk is low due to the takedown, but similar domains could emerge, so continued vigilance is advised.