bafkreifm5v2lbfpkifubdvv2qyamasb5kaeg6vzo7zvxotvjmygaq7ylka[.]ipfs[.]dweb[.]link

The domain bafkreifm5v2lbfpkifubdvv2qyamasb5kaeg6vzo7zvxotvjmygaq7ylka.ipfs.dweb.link is actively involved in credential phishing. It is currently flagged by 9 out of 91 vendors on VirusTotal, indicating a moderate level of detection across the security community. The domain is registered with CSC Corporate Domains, Inc., and is hosted on IP address 209.94.90.3 in the United States, operated by Protocol Labs.

The phishing page, titled 'EmailLogin', is designed to deceive users into entering their credentials, which can then be exploited by malicious actors. The domain's platform risk score is notably high at 78 out of 100, reflecting its potential threat to users. Despite its creation date in 2017, PhishDestroy only identified its malicious activity on June 21, 2026, suggesting a recent activation or change in behavior.

With an abuse score of 9 out of 100, the domain shows limited reported abuse, possibly due to its recent detection and the specific targeting of victims. The SSL certificate issued by Let's Encrypt adds a layer of perceived legitimacy, which can mislead users into trusting the site. The domain is currently listed on one public blocklist, specifically by PhishDestroy, underscoring its active threat status. This case highlights the importance of timely detection and reporting in mitigating phishing risks.