bafkreia4po4p3snus6dqmtrthweutc2u2eauevwyvbevc2s56cyytrpw5u[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreia4po4p3snus6dqmtrthweutc2u2eau.ipfs.dweb.link as an active generic phishing domain under investigation for credential theft activities. This domain, registered through CSC Corporate Domains, Inc., exhibits suspicious characteristics aligned with unauthorized data harvesting campaigns targeting unsuspecting users. The risk level remains under investigation due to emerging threat intelligence, though initial indicators suggest potential for significant harm if left unaddressed. This domain was flagged with a 17/95 detection rate on VirusTotal as of the latest scan, indicating no immediate blocklist recognition despite its malicious potential. Registered on February 24, 2017, it resolves to IP address 209.94.90.3 and operates under a Let’s Encrypt SSL certificate, which may lend false legitimacy to its operations. The lack of detections, combined with its age and hosting infrastructure, suggests a stealthy or newly deployed threat actor leveraging long-standing domains for credential theft campaigns. Trust scores remain unverified due to the domain’s limited visibility in conventional threat intelligence feeds. To mitigate risks associated with this credential theft domain, users should avoid interacting with any login prompts or input forms linked to this address. Organizations are advised to block the domain at the network level and update firewall rules to include IP 209.94.90.3. Security teams should monitor for unusual authentication attempts from this domain and flag any compromised credentials for immediate rotation. Additionally, users who may have already entered sensitive information should enable multi-factor authentication on all associated accounts and conduct a thorough security audit. Proactive threat hunting for similar domains is recommended to prevent further exploitation.