bafkreicxtiuwh6kjuloo2ypwnk4uujodhb3p2ewjjpkh6rg72nfeffopkq[.]ipfs[.]dweb[.]link

PhishDestroy identifies a high-risk credential harvesting domain impersonating a Webmail Portal Login interface. This active threat employs a deceptive login page to trick users into surrendering email credentials, enabling account takeover and potential corporate espionage. The domain resolves to IP 209.94.90.3, a known malicious host, and was created on February 24, 2017 through CSC Corporate Domains, Inc. This domain was flagged by 19 out of 95 VirusTotal security vendors, indicating strong consensus on its malicious nature. It appears on at least 1 security blocklist, including OpenPhish, and holds no trustworthiness under scrutiny. Its SSL certificate, issued by Let’s Encrypt, offers no protection against phishing and may even increase user trust in the fake login page. Users should avoid accessing this domain entirely and report it to their security teams. Organizations should block the domain at the network and DNS levels, revoke any issued SSL certificates if possible, and educate employees on recognizing phishing pages mimicking internal login portals. Immediate incident response is recommended if credentials were entered.