bafkreiarebs6fzk2fdl7nwihhbwejvw5pwuhytyqvpy7375stgw6m32haa[.]ipfs[.]dweb[.]link

This domain, bafkreiarebs6fzk2fdl7nwihhbwejvw5pwuhytyqvpy7375stgw6m32haa.ipfs.dweb.link, is identified as a generic phishing infrastructure targeting user credentials through an imitation email login interface. The page title, EmailLogin, suggests an attempt to deceive users into entering sensitive account information by mimicking legitimate email service portals. No specific brand impersonation or cryptocurrency drainer kit signatures were detected in initial analysis, though the generic nature of the phishing page increases its potential reach across multiple platforms.

Infrastructure analysis reveals the following technical indicators: the domain was registered on June 8, 2026, through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.2. Security vendor detections on VirusTotal stand at 18 out of 95 engines, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist and is currently flagged by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and automation capabilities. No Google Safe Browsing (GSB) listing was observed at the time of analysis.

As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat due to the possibility of reactivation or migration to alternative domains. Organizations and users are advised to monitor for similar IPFS-based phishing attempts, particularly those leveraging decentralized web links. Network-level blocking of the associated IP address (209.94.90.2) and domain is recommended as a precautionary measure. Continuous monitoring of credential theft attempts and user education on recognizing phishing indicators remain critical defensive actions.