bafybeiclh4rdjgenba3udk2t6t7k6mg2xhf5z6vspwffh4vtbgqqrfwbwe[.]ipfs[.]dweb[.]link

PhishDestroy has identified an active generic phishing site hosted on an IPFS gateway domain that mimics legitimate login pages to harvest user credentials. The landing page is designed to appear authentic but is controlled by attackers to capture any information submitted, including usernames, passwords, and multi-factor authentication codes. The threat actor behind this campaign uses social engineering tactics, such as impersonating trusted brands or services, to trick victims into providing sensitive data.

This domain was flagged by 11 out of 95 VirusTotal security vendors, indicating moderate but concerning detection across the security community. It was created on February 24, 2017, and is registered through CSC Corporate Domains, Inc. The site resolves to the IP address 209.94.90.2 and uses a Let's Encrypt SSL certificate, which may lend it an appearance of legitimacy. These details suggest the domain has been in use for years, possibly repurposed for malicious activity.

If you visited this domain and entered any personal information, immediately change your passwords for the affected accounts and enable multi-factor authentication where possible. Monitor your financial accounts and other sensitive services for unusual activity. Run a full antivirus scan on your device and consider resetting passwords from a different, trusted device. Report the incident to your organization’s security team or, if personal, to the legitimate service being impersonated.