bafkreibvm36fn57gu5x7osnyjuuxbdkgnmtvgszm67aqaqlk55wq4n3jzq[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated-risk generic phishing threat designed to mimic corporate webmail infrastructure. Analysis indicates the resource, hosted under the InterPlanetary File System (IPFS) gateway bafkreibvm36fn57gu5x7osnyjuuxbdkgnmtvgszm67aqaqlk55wq4n3jzq.ipfs.dweb.link, specifically impersonates Rackspace Webmail login portals to harvest business email credentials. The page title, 'Rackspace Webmail: Hosted Email for Business,' aligns with known phishing tactics targeting enterprise users through spoofed authentication interfaces. Infrastructure analysis reveals the domain resolves to the IP address 209.94.90.3, geolocated within the United States under AS40680 (Protocol Labs). The domain was registered through CSC Corporate Domains, Inc. on March 9, 2026, an anomalous creation date suggesting potential domain spoofing or registry manipulation. Security telemetry indicates the domain appears on one blocklist and is actively blocked by at least one threat intelligence feed. SSL certification is provided by Let’s Encrypt (serial number E7), a common tactic among phishing actors to lend superficial legitimacy. VirusTotal detection metrics report 20 out of 95 security vendors flag the domain as malicious, a detection rate consistent with mid-tier phishing campaigns. Mitigation against this threat type requires multi-layered defensive measures. Network-level protections should include blocking the IP address 209.94.90.3 and monitoring for connections to AS40680, particularly for outbound requests to IPFS gateways. Organizations should implement strict email filtering rules to quarantine messages containing links to IPFS-hosted resources or domains registered through CSC Corporate Domains within the past 12 months. Endpoint detection systems should be configured to alert on processes attempting to access spoofed webmail domains, particularly those impersonating Rackspace infrastructure. User training should emphasize verification of SSL certificates, scrutiny of domain structures (e.g., IPFS gateways), and reporting of suspicious login pages to internal security teams for further analysis.