bafkreidonfpb5ukq3hkowsjrmblah4hnpk4mpsn4utarq3g5mcxm2hfqmy[.]ipfs[.]dweb[.]link

This domain, bafkreidonfpb5ukq3hkowsjrmblah4hnpk4mpsn4utarq3g5mcxm2hfqmy.ipfs.dweb.link, is actively hosting a generic phishing threat specifically designed as a fake email login portal. Analysis of the page title, EmailLogin, indicates the domain is impersonating legitimate email service providers to harvest user credentials. The infrastructure remains operational as of the latest assessment, with no evidence of takedown or mitigation efforts observed. Infrastructure analysis reveals the domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and currently resolves to the IP address 209.94.90.2, located within the United States under AS40680 (Protocol Labs). The domain is flagged by 18 of 95 security vendors on VirusTotal, indicating a high level of consensus regarding its malicious nature. Additionally, it appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt, a common characteristic observed in phishing campaigns due to the ease of acquisition. The domain's creation date suggests it may have been repurposed for malicious activity, as its longevity does not align with typical phishing domain lifespans. Current threat assessment classifies this domain as high-risk due to its active status, confirmed credential harvesting intent, and consistent detection by security vendors. Organizations and end-users are advised to block access to this domain at the network level and implement real-time monitoring for any connections to the associated IP address, 209.94.90.2. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and review connected devices for signs of compromise. Security teams are recommended to correlate logs for any outbound connections to the domain or its resolving IP to identify potential breaches.