bafkreiadzqck2lfgvfyf67l2yqxfdp6g2me6hm335nb5x22qw5rsht44hy[.]ipfs[.]dweb[.]link

The domain bafkreiadzqck2lfgvfyf67l2yqxfdp6g2me6hm335.ipfs.dweb.link was identified as a generic phishing threat specializing in fake email login credential harvesting. Analysis of the page title, 'EmailLogin,' indicates an attempt to impersonate a legitimate email service provider login portal. The domain is currently offline, but prior activity suggests it was actively used to deceive users into submitting sensitive credentials. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating a moderate-to-high confidence in its malicious classification. It resolves to the IP address 209.94.90.3, hosted by Protocol Labs in the United States. The domain was registered on April 26, 2026, through CSC Corporate Domains, Inc., a registrar commonly associated with both legitimate and malicious registrations. The SSL certificate is issued by Let's Encrypt, a common practice among threat actors to lend a false sense of legitimacy. The domain appears on at least one security blocklist, further corroborating its malicious intent. Current status confirms the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure and registration patterns suggest potential for re-emergence under a similar or altered domain. Organizations and users are advised to implement the following measures: block the domain and associated IP address (209.94.90.3) at the network perimeter; monitor for similar phishing attempts using IPFS-based domains or Let's Encrypt certificates; and educate users on recognizing fake login portals, particularly those mimicking email service providers. Security teams should also review logs for any prior interactions with this domain to assess potential credential exposure.