bafkreifqccvbywrjj7ntbsp35ecgvn2dt7sbafarthzfq5thqy4gedfkia[.]ipfs[.]dweb[.]link

This domain, identified by the unique seed bd9507, operates as an IPFS-hosted resource under the dweb.link gateway and is flagged for brand impersonation targeting generic email services. Analysis of the page title, Microsoft | Login, confirms the domain presents a fraudulent Microsoft login interface designed to harvest user credentials. No explicit crypto drainer kit signatures were detected, but the infrastructure aligns with credential phishing campaigns commonly used to facilitate account takeovers or subsequent financial fraud. Infrastructure analysis reveals concrete technical indicators associated with this threat. The domain is detected by 19 out of 95 security vendors on VirusTotal, indicating moderate consensus on its malicious nature. It was registered through CSC Corporate Domains, Inc. on November 29, 2021, and resolves to the IP address 209.94.90.2, hosted within AS40680 (Protocol Labs) in the United States. The domain appears on one security blocklist and was not listed on Google Safe Browsing at the time of assessment. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while not inherently malicious, is frequently leveraged by threat actors due to its accessibility and short-lived validity periods. As of the latest assessment, the domain has been taken offline, reducing immediate exposure to end users. However, the underlying infrastructure remains a latent risk, as IPFS-based threats can be re-deployed or mirrored across alternative gateways with minimal effort. The registrar, CSC Corporate Domains, Inc., has not publicly disclosed remediation actions, and the IP address continues to host other potentially malicious content. Users and organizations are advised to block the IP 209.94.90.2 at the network perimeter and monitor for similar IPFS-based phishing attempts targeting Microsoft or other email service brands. Credential monitoring and multi-factor authentication enforcement are recommended to mitigate residual risk from compromised accounts.