bafkreigaygohycgvmse72altlxwthxxnd7hjakkwi44rvsdhoeabsu33oe[.]ipfs[.]dweb[.]link

This domain, bafkreigaygohycgvmse72altlxwthxxnd7hjakkwi44rvsdhoeabsu33oe.ipfs.dweb.link, is identified as a high-risk threat for credential theft, specifically designed to trick users into surrendering their login credentials. The domain mimics legitimate email login pages to capture sensitive information, posing a significant risk to user data security.

Analysis indicates that the domain has been flagged by 18 out of 95 security vendors on VirusTotal, suggesting a notable level of suspicion and potential malicious activity. The domain is registered through CSC Corporate Domains, Inc., and was created on April 26, 2026. It resolves to the IP address 209.94.90.2, which is located in the United States and is associated with Protocol Labs. The domain appears on one security blocklist and is blocked by PhishDestroy, indicating that it has been recognized as a threat by multiple cybersecurity platforms.

If users have visited this domain, they should immediately change their login credentials for any accounts that may have been compromised. Additionally, users should monitor their accounts for any unauthorized activity and consider enabling two-factor authentication (2FA) to enhance security. Reporting the incident to their respective email service providers and cybersecurity authorities is also recommended to help mitigate the threat and protect others from falling victim.