bafkreieom7wda46qcf4vncqryfpzbkb5wv4cnqj54bohacy36x6jbx22z4[.]ipfs[.]dweb[.]link

This domain, bafkreieom7wda.ipfs.dweb.link, is identified as a generic phishing threat designed to impersonate a professional email login portal. Analysis indicates the page title, Sign in - Professional Email, suggests an attempt to deceive users into entering credentials for corporate or personal email accounts. The domain does not appear to be associated with a known cryptocurrency drainer kit or brand-specific impersonation, but rather operates as a broad credential harvesting scheme. The infrastructure leverages IPFS (InterPlanetary File System) to host the phishing content, a tactic increasingly observed in evasive phishing campaigns due to its decentralized and resilient nature. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 209.94.90.3, located in the United States under AS40680 (Protocol Labs). The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. The domain was registered on March 08, 2026, through CSC Corporate Domains, Inc., a registrar frequently utilized by enterprise clients, which may contribute to the domain's perceived legitimacy. VirusTotal detections stand at 18 out of 95 security vendors, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist, and Google Safe Browsing (GSB) does not currently list it as a known threat, though this may reflect a delay in detection rather than benign status. As of the latest assessment, the domain has been taken offline, likely in response to detection by security mechanisms such as PhishDestroy. However, the risk of re-emergence remains elevated due to the decentralized hosting model provided by IPFS, which complicates takedown efforts. Users who may have interacted with this domain are advised to rotate credentials immediately, particularly if the same password was reused across multiple services. Organizations should monitor for unauthorized access attempts and implement multi-factor authentication (MFA) to mitigate the impact of credential compromise. The use of IPFS in this campaign underscores the need for enhanced monitoring of decentralized content delivery networks, as traditional takedown mechanisms may prove less effective against such threats.