bafkreihlel6wllbosgrymn5dx262iludlgdr6lce4wa4oyyjwts72uvz2q[.]ipfs[.]dweb[.]link

This domain, bafkreihlel6wllbosgrymn5dx262iludlgdr6lce4wa4oyyjwts72uvz2q.ipfs.dweb.link, is flagged for its involvement in generic phishing activities, specifically targeting users with fake login pages. The intent is to deceive users into entering their login credentials, which can then be harvested by threat actors for unauthorized access to accounts and potential financial fraud.

Analysis indicates that the domain has been flagged by 18 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion and potential risk. The domain was registered through CSC Corporate Domains, Inc. on April 26, 2026, and currently resolves to the IP address 209.94.90.3. The domain has a Gridinsoft trust score of 0/100 and appears on one security blocklist, further corroborating its malicious nature. The infrastructure used includes IPFS and Cloudflare, with HTTP/3 support and a Let's Encrypt SSL certificate.

If users have visited this domain, it is recommended to immediately change passwords for any accounts that may have been accessed, particularly email and financial accounts. Users should also monitor their financial statements and credit reports for any unusual activity. Additionally, enabling two-factor authentication (2FA) on all critical accounts can provide an additional layer of security. Users are advised to remain vigilant and report any suspicious activity to their respective service providers.