bafkreig5vx6vfnqbg7zvesjo33mqzs2mvgatdknjxuif7hcxybqrh6vmty[.]ipfs[.]dweb[.]link

Analysis indicates bafkreig5vx6vfnqbg7zvesjo33mqzs2mvgatdknjxuif7hcxybqrh6vmty.ipfs.dweb.link is a generic_phishing endpoint hosted via IPFS gateway infrastructure. The landing page is titled "EmailLogin", strongly indicating a credential-harvesting login lure designed to impersonate email authentication portals. No legitimate brand association is confirmed, and the structure suggests a template-based fake login kit intended to capture user credentials.

Technical indicators show a VirusTotal detection ratio of 17/95 security vendors flagging the domain as malicious. The domain is registered through CSC Corporate Domains, Inc., and resolves to IP 209.94.90.2. It was created on February 24, 2017, indicating long-lived infrastructure potentially repurposed for abuse. The host operates under AS40680 (Protocol Labs), consistent with IPFS-based distribution. The domain appears on 1 security blocklist, specifically PhishDestroy. SSL configuration uses a Let's Encrypt certificate (E8), commonly observed in rapidly deployed phishing environments.

Current status remains active, suggesting ongoing exposure risk to end users. Despite early detection signals and partial blocklisting, the domain continues to resolve and serve content. The combination of IPFS hosting, validated phishing classification, and moderate-to-high VT detection (17/95) indicates persistent malicious utility. Recommended response actions include network-level blocking, threat intelligence sharing, and continuous monitoring for related IPFS gateway domains. End users should avoid interacting with the EmailLogin page and treat any credential prompts as hostile, as compromise could lead to account takeover and downstream credential reuse attacks.