bafkreif5lfunnqqjfepptecgyu47hthggdzkw6sw6ldu5q7ax5b5k6g4me[.]ipfs[.]dweb[.]link

This domain, bafkreif5lfunnqqjfepptecgyu47hthggdzkw6sw6ldu5q7ax5b5k6g4me.ipfs.dweb.link, operates as a generic phishing site designed to harvest email credentials. The page displays a fraudulent login portal titled 'EmailLogin,' tricking visitors into submitting sensitive account information. Analysis indicates the site does not target a specific brand but instead uses a generic interface to maximize potential victims, particularly those redirected from malicious links or deceptive advertisements. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain, created on February 24, 2017, is registered through CSC Corporate Domains, Inc., a registrar frequently associated with phishing infrastructure. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while the IP address 209.94.90.3, hosted by Protocol Labs in the US, resolves to this phishing endpoint. The site also appears on one security blocklist and uses a Let's Encrypt SSL certificate (E8), a common tactic to lend false legitimacy to fraudulent pages. Visitors who interacted with this domain should take immediate action to mitigate risk. First, reset any credentials entered on the site, particularly email passwords, using a secure device. Enable multi-factor authentication on all accounts to prevent unauthorized access. Monitor financial and communication platforms for signs of compromise, such as unauthorized logins or messages. If corporate credentials were exposed, report the incident to internal security teams for further investigation. The domain is currently offline, but similar threats may persist; users should verify URLs carefully before entering login details and avoid clicking unsolicited links.