bafkreiecvycccw636eu24sboxdcwg2incfh7vhgt3vlqbbhv37ztbyaev4[.]ipfs[.]dweb[.]link

This domain is flagged for brand impersonation, specifically targeting a generic email service. The site, which displays a 'Webmail Sign-in' page, is designed to trick users into entering their email credentials, leading to potential unauthorized access and data theft.

Analysis indicates that the domain bafkreiecvycccw636eu24sboxdcwg2incfh7vhgt3vlqbbhv37ztbyaev4.ipfs.dweb.link was created on February 24, 2017. It has been flagged by 20 out of 95 security vendors on VirusTotal, and is listed on two security blocklists, PhishDestroy and PhishingDB. The domain is registered through CSC Corporate Domains, Inc., and resolves to an IP address (209.94.90.3) located in the United States, under the Autonomous System AS40680 Protocol Labs. The SSL certificate is issued by Let's Encrypt, which is a common choice for both legitimate and malicious sites.

If a user has visited this domain, it is recommended to immediately change the passwords for any email accounts that were accessed through this site. Additionally, users should monitor their email accounts for any unauthorized activity and consider enabling two-factor authentication (2FA) for added security. Reporting the incident to the email provider and reviewing account settings for any suspicious changes can also help mitigate potential risks.