bafkreihpec5h3lagmctlyyobawh3wffvtpk44srberrpyspxntqteq53qq[.]ipfs[.]dweb[.]link

This domain, bafkreihpec5h3.ipfs.dweb.link, is identified as a generic phishing threat targeting users through a fraudulent Professional Email login interface. Analysis of the page title, 'Sign in - Professional Email,' indicates an attempt to deceive users into submitting credentials by mimicking legitimate email service providers. No specific brand or drainer kit signatures were detected, though the infrastructure aligns with common phishing-as-a-service frameworks leveraging decentralized storage. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc., with a creation date of November 29, 2021. It resolves to the IP address 209.94.90.3, hosted under AS40680 (Protocol Labs) in the United States. The domain is flagged by Google Safe Browsing as phishing and appears on two security blocklists. VirusTotal detection rates show 17 out of 95 security vendors marking the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its accessibility. As of the latest assessment, the domain has been taken offline, reducing immediate exposure. However, residual risk persists due to the decentralized nature of IPFS-based phishing, where content may resurface under different gateways or hashes. Response actions should include monitoring for re-emergence of the content under alternate identifiers and updating blocklists to prevent access via other gateways. Organizations are advised to audit logs for prior connections to the IP 209.94.90.3 and review credential security for accounts that may have interacted with the domain.