bafkreiduykwccoklbuw3uyl2gf6ntlz6aqkiaqkc67clha2qhatlkjdzyi[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreiduykwccoklbuw3uyl2gf6ntlz6aqkiaqkc67clha2qhatlkjdzyi.ipfs.dweb.link as a high-risk credential theft domain actively harvesting email login credentials. The site mimics an EmailLogin page, tricking users into surrendering sensitive authentication details under false pretenses. This technique, known as brand impersonation via fake login portals, is a favored method among cybercriminals to gain unauthorized access to personal and corporate accounts, enabling subsequent account takeovers and data breaches. This domain was flagged by 12 out of 95 VirusTotal security vendors, indicating significant malicious activity. Registered through CSC Corporate Domains, Inc. on February 24, 2017, the domain resolves to IP address 209.94.90.3 and operates with a Let's Encrypt SSL certificate to appear legitimate. Despite its age, the domain remains uncategorized by major blocklists and maintains neutral trust scores, suggesting a stealthy, long-term operation designed to evade detection. The combination of an aged domain, trusted SSL, and limited vendor detection highlights a sophisticated threat actor leveraging trusted infrastructure for malicious purposes. To mitigate credential theft risks, users should avoid entering credentials into unfamiliar or unsolicited login pages, even if they appear legitimate. Verify the domain URL and use multi-factor authentication to add an extra layer of security. Organizations should deploy DNS filtering to block access to this domain and similar threats, while security teams should monitor for unusual login attempts or data exfiltration patterns. Immediate action includes reporting this domain to threat intelligence platforms and updating firewall rules to prevent access.