bafkreie4pdizjo3n36fx25nbqcvazgntc3ib5zxygqe6ewmxz2tw5wognm[.]ipfs[.]dweb[.]link

The domain bafkreie4pdizjo3n36fx25nbqcvazgntc3ib5zxygqe6ewmxz2tw5wognm.ipfs.dweb.link is identified as an elevated-risk brand impersonation threat. The domain is currently offline and impersonates a generic email service, specifically targeting the sign-in page of webmail services.

Analysis of the domain reveals that it has been flagged by 19 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion among the security community. The domain is registered through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.2, which is located in the United States and is part of the AS40680 Protocol Labs network. The domain was created on February 24, 2017, and has an SSL certificate issued by Let's Encrypt, with a trust score of E7. It appears on 2 security blocklists and is blocked by PhishDestroy and PhishingDB.

The current status of the domain being offline reduces the immediate risk, but it is crucial to remain vigilant as the infrastructure may be reactivated. Recommendations include adding the domain to organizational blocklists, monitoring for any signs of reactivation, and conducting user awareness training to identify and avoid such impersonation attempts. Additionally, implementing multi-factor authentication (MFA) for webmail services can significantly enhance security and prevent unauthorized access.