bafkreictvr4yo2a5r3y4i6dsfyg5b5qvfmxztsykx2xcwgfw5ikb6zvdau[.]ipfs[.]dweb[.]link

This domain is flagged as a high-risk generic credential phishing threat. Analysis indicates the infrastructure is designed to harvest login credentials, financial details, or other sensitive user data through deceptive interfaces mimicking legitimate services. The domain remains active, posing an immediate risk to unprotected systems and end-users. Infrastructure analysis reveals the domain was registered on June 08, 2026, through CSC Corporate Domains, Inc. It is currently detected by 18 out of 95 security vendors on VirusTotal, with a presence on at least one security blocklist. The domain leverages IPFS (InterPlanetary File System) via the dweb.link gateway, a technique increasingly observed in phishing campaigns to evade traditional takedown mechanisms. No associated IP addresses or subdomains have been publicly documented at this time, though historical patterns suggest dynamic resolution may be employed. Mitigation requires immediate blocking of the domain at the DNS and proxy levels. Network administrators should implement strict filtering rules to prevent resolution of bafkreictvr4yo2a5r3y4i6dsfyg5b5qvfmxztsykx2xcwgfw5ikb6zvdau.ipfs.dweb.link and monitor for related C2 callbacks or data exfiltration attempts. End-user education should emphasize the risks of interacting with unverified IPFS-hosted content, particularly links distributed via email or messaging platforms. Security teams are advised to correlate logs for connections to this domain and investigate any prior access for potential credential compromise.