bafkreibx5onkfrutd2rnwc6piikm6nwyh67qsw6ysba3bx2x43i4uzrzzy[.]ipfs[.]dweb[.]link

The domain bafkreibx5onkfrutd2rnwc6piikm6nwyh67qsw6ysba3bx2x43i4uzrzzy.ipfs.dweb.link is a phishing site that impersonates an email login page. This domain, hosted in the United States under IP 209.94.90.3, is associated with Protocol Labs and was issued an SSL certificate by Let's Encrypt. Despite its offline status, it has been flagged as malicious by 14 out of 92 vendors on VirusTotal, indicating a significant threat level.

Registered through CSC Corporate Domains, Inc., the domain was created on May 14, 2026. It has been listed on one public blocklist, specifically PhishDestroy's. The site's primary function was to deceive users into providing their email credentials by masquerading as a legitimate login portal. This tactic is a common phishing strategy, exploiting users' trust in familiar interfaces.

The fact that 14 vendors have identified this domain as malicious underscores its potential impact before being taken down. The use of a Let's Encrypt SSL certificate may have lent the site an appearance of legitimacy, further aiding in its deceptive practices. While the domain is currently offline, the rapid detection and blocking by PhishDestroy highlight the importance of proactive threat intelligence in neutralizing such threats. By capturing this domain in the early stages of its lifecycle, PhishDestroy's efforts demonstrate the effectiveness of upstream monitoring in combating emerging phishing threats.