bafkreifnivhbvpt4lmyejgjihpdtdkvcblvdhq6d7bs7zowgmtygobvdvy[.]ipfs[.]dweb[.]link

The domain bafkreifnivhbvpt4lmyejgjihpdtdkvcblvdhq6d7bs7zowgmtygobvdvy.ipfs.dweb.link has been identified as a credential theft phishing threat, currently taken offline. This site masqueraded as a Webmail sign-in page to steal user login credentials. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and was hosted at IP address 209.94.90.2 with an SSL certificate from Let's Encrypt (E8).

According to intelligence data, this domain was flagged by 19 out of 95 VirusTotal security vendors, indicating a high level of malicious consensus. It also appeared on one security blocklist. Despite its long registration history, the site was only recently identified as a phishing operation and has been taken offline. The IP address and hosting details suggest the infrastructure was likely used for credential harvesting campaigns targeting webmail users.

Given the elevated risk and the specific threat of credential theft, users who may have interacted with this domain should immediately change their email passwords and enable multi-factor authentication. Organizations should review access logs for any connections to this domain and block the IP address 209.94.90.2 at the network level. PhishDestroy recommends ongoing monitoring for similar IPFS-based phishing domains and educating users about verifying legitimate webmail URLs before entering credentials.