bafkreiev2xwzov65567o5mvynqhjenrrg57ml2zlxqznsx7e6residgaqm[.]ipfs[.]dweb[.]link

This domain is assessed as an elevated-risk generic phishing threat. The domain bafkreiev2xwzov65567o5mvynqhjenrrg57ml2zlxqznsx7e6residgaqm.ipfs.dweb.link has been flagged for its involvement in phishing activities, specifically targeting users with a deceptive login page titled 'EmailLogin'.

Analysis indicates that the domain has been flagged by 19 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion among the cybersecurity community. The domain is registered through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.3, which is located in the United States and operated by Protocol Labs. The domain was created on April 26, 2026, and currently appears on one security blocklist, indicating that it has been identified as a threat by at least one reputable security organization. The SSL certificate for the domain is issued by Let's Encrypt, which is a common certificate authority used by legitimate and malicious entities alike. The domain's current status is offline, which may be a result of takedown efforts or a temporary suspension of malicious activities.

To mitigate the risk associated with this generic phishing threat, users and organizations should employ robust security measures. These include updating and maintaining anti-phishing software, conducting regular security awareness training to recognize phishing attempts, and implementing multi-factor authentication (MFA) for email and other critical accounts. Network administrators should also monitor for any attempts to access this domain and block it at the network level to prevent potential exposure. Additionally, sharing this intelligence with other security teams and platforms can help in broader detection and prevention efforts.