bafkreih64laewalbroop3732ynvah5s4yrgp457gezwlsqbemzricttuky[.]ipfs[.]dweb[.]link

This domain, bafkreih64laewalbroop3732ynvah5s4yrgp457gezwlsqbemzricttuky.ipfs.dweb.link, is identified as a brand impersonation threat targeting generic email services. The page title 'Webmail Sign-in' suggests an intent to harvest user credentials by mimicking legitimate email login portals. No specific crypto drainer kit signatures were detected, but the infrastructure aligns with credential theft campaigns observed in prior incidents. The domain leverages IPFS decentralized hosting via the dweb.link gateway, a tactic increasingly adopted to evade takedowns and complicate attribution. Analysis indicates the domain resolves to the IP address 209.94.90.2, hosted under AS40680 (Protocol Labs) in the United States. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains due to its free and automated issuance process. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., though the malicious activity likely represents a recent compromise or repurposing of existing infrastructure. VirusTotal records show 21 out of 95 security vendors flagging the domain as malicious, while it appears on 2 distinct security blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's presence on multiple blocklists suggests prior detection. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, the underlying infrastructure (IPFS content identifier and gateway) may persist, allowing threat actors to relaunch the attack with minimal modifications. Organizations are advised to block the domain and its resolving IP (209.94.90.2) at the network perimeter, monitor for related subdomains or gateways, and alert users to the credential theft risk associated with 'Webmail Sign-in' impersonation. Given the elevated risk level, endpoint protection systems should be updated to include this domain in their threat intelligence feeds, and security teams should review logs for prior interactions with the IPFS gateway or resolving IP.