bafkreici6nv56agv2t5tpzzcn4y4mpqu4fgfac7rnpn2vudtxg7gu76afu[.]ipfs[.]dweb[.]link

The domain bafkreici6nv56agv2t5tpzzcn4y4mpqu4fgfac7rnpn2vudtxg7gu76afu.ipfs.dweb.link is flagged as malicious by 16 out of 92 vendors on VirusTotal. Despite its offline status, the domain's previous activity indicates a phishing threat, with a page title of 'EmailLogin' suggesting an attempt to harvest user credentials.

Registered through CSC Corporate Domains, Inc., the domain was hosted on an IP address associated with Protocol Labs in the United States. The SSL certificate was issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its ease of access and automation. The presence of this domain on a public blocklist, specifically PhishDestroy, underscores its threat level.

The domain's use of the IPFS (InterPlanetary File System) gateway at dweb.link reflects a growing trend among threat actors to exploit decentralized hosting platforms. These platforms can complicate takedown efforts due to their distributed nature. However, the domain's current offline status suggests successful mitigation efforts.

This case highlights the importance of early detection and intervention in the lifecycle of phishing threats. The swift identification and subsequent takedown of this domain demonstrate effective threat management strategies. The proactive inclusion of the domain in PhishDestroy's blocklist further aids in protecting users from potential credential theft and other malicious activities.