bafybeigz3zfosvwiso3abzamcwdp6v2o4xasnj4smntd4uienjeb2sklle[.]ipfs[.]dweb[.]link

The domain bafybeigz3zfosvwiso3abzamcwdp6v2o4xasnj4smntd4uienjeb2sklle.ipfs.dweb.link has been identified as a brand impersonation threat targeting Generic Email services, specifically mimicking Webmail login portals. Analysis confirms the domain is currently offline, though prior activity indicates a deliberate attempt to deceive users into disclosing credentials. The page title 'Webmail' further corroborates the intent to impersonate legitimate email service providers, a common tactic in credential harvesting campaigns. Technical indicators reveal the domain was registered through CSC Corporate Domains, Inc. on February 24, 2017, though malicious activity associated with this specific subdomain path appears to be more recent. The domain resolves to the IP address 209.94.90.2, hosted under AS40680 (Protocol Labs) in the United States. Detection metrics show 18 of 95 security vendors on VirusTotal flagged this domain as malicious, while it appears on two independent security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the risk, as phishing domains frequently leverage valid certificates to appear legitimate. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure changes. However, the underlying threat remains relevant due to the domain's historical use in phishing operations. Organizations and users are advised to block the domain and its resolving IP (209.94.90.2) at the network level, particularly in environments where Generic Email or Webmail services are utilized. Security teams should monitor for similar impersonation attempts using IPFS or decentralized web infrastructure, as these platforms are increasingly exploited for phishing due to their perceived anonymity. End-users should verify the authenticity of Webmail login pages by checking for official domain names, SSL certificate details, and multi-factor authentication prompts before entering credentials.