bafybeihaaavrjcaqwqvhgb55rx6h2mm6cqvbfuxrk35fr4hcje6b4defpa[.]ipfs[.]dweb[.]link

The domain bafybeihaaavrjcaqwqvhgb55rx6h2mm6cqvbfuxrk35fr4hcje6b4defpa.ipfs.dweb.link is identified as a credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though prior activity involved harvesting authentication details via fraudulent web forms designed to mimic legitimate services. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential harvesting campaigns observed in recent months. Infrastructure analysis reveals the domain resolves to the IP address 209.94.90.3 and was registered on April 01, 2026, through CSC Corporate Domains, Inc. Security vendors have flagged this domain in 15 of 95 VirusTotal scans, while it appears on two security blocklists, including PhishDestroy and OISD. The SSL certificate is issued by Let’s Encrypt, a common practice among threat actors to lend superficial legitimacy. Gridinsoft’s trust assessment assigns a score of 0 out of 100, reinforcing the domain’s high-risk classification. Given the domain’s current offline status, immediate threats to end users are mitigated. However, security teams should treat this infrastructure as compromised and enforce blocking at the DNS or network level to prevent potential reactivation. Organizations are advised to monitor logs for connections to 209.94.90.3 and review recent authentication attempts for anomalies. Proactive measures include updating endpoint protection rules and educating users on recognizing credential theft tactics, particularly those leveraging decentralized web links.