bafkreie3a7xaucdsxazp7puvj73h66txlux7hcpqdsy5axahykzrblqmxa[.]ipfs[.]dweb[.]link

PhishDestroy has identified a generic phishing domain hosted on the InterPlanetary File System (IPFS) at bafkreie3a7xaucdsxazp7puvj73h66txlux7hcpqdsy5axahykzrblqmxa.ipfs.dweb.link. The page title is "EmailLogin," suggesting a credential harvesting attack targeting email accounts. No specific brand or drainer kit has been associated with this threat, but the use of IPFS indicates an attempt to evade traditional takedown mechanisms.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports show 14 out of 95 security vendors flagging this domain as malicious, a strong signal of widespread detection. The domain was registered through CSC Corporate Domains, Inc. and created on February 24, 2017, giving it a long history. It resolves to IP address 209.94.90.3 and uses an SSL certificate issued by Let's Encrypt (E8). Additionally, the domain appears on one security blocklist, while Google Safe Browsing status is not explicitly mentioned in the provided data.

As of the latest check, this domain is offline, indicating that hosting or the domain itself has been taken down, likely in response to security reports. However, the residual risk remains, as the same attacker may deploy similar pages on other IPFS hashes or domains. Users who may have encountered this page should change their email passwords immediately and enable two-factor authentication. PhishDestroy continues to monitor for related threats and recommends blocking the associated IP and domain pattern in network defenses.