bafkreig5enqqqyp6dsqxnigh24ohusgeuj6isoahjunig3qvoarcem5qeu[.]ipfs[.]dweb[.]link

The domain bafkreig5en.ipfs.dweb.link is identified as a generic phishing threat specifically designed to impersonate an email login portal. Analysis indicates the page title 'EmailLogin' was actively used to deceive users into submitting credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented risk. Infrastructure analysis reveals the domain was flagged by 20 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It was registered through CSC Corporate Domains, Inc. on April 27, 2026, and resolved to the IP address 209.94.90.3, hosted by Protocol Labs in the United States. The domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (serial number E8). These technical indicators confirm its use in phishing operations targeting unsuspecting users. Given the elevated risk level and confirmed malicious activity, organizations and users are advised to treat any prior interactions with this domain as compromised. Immediate steps include revoking any credentials entered on the site, monitoring for unauthorized access, and implementing blocklist updates to prevent future exposure. Network administrators should verify logs for connections to 209.94.90.3 and the domain itself, ensuring no residual access remains. Proactive measures such as multi-factor authentication and user education on phishing tactics are recommended to mitigate similar threats.