bafkreig6osgy7ndyfux3ma7lukuwogvviqc6nmpd62qrsvsamsgzg5hawa[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated-risk generic phishing threat specializing in fake email login credential harvesting. Analysis indicates the infrastructure is designed to impersonate legitimate email authentication portals, tricking users into submitting sensitive login details under false pretenses. The specific threat type—fake EmailLogin portal—aligns with common phishing tactics targeting corporate and personal email accounts to facilitate account takeovers or subsequent social engineering attacks. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 209.94.90.2 and was registered through CSC Corporate Domains, Inc. on February 24, 2017. Security vendors on VirusTotal flag the domain at 18/95 detections, while Gridinsoft assigns a trust score of 0/100. The domain appears on at least one security blocklist and is currently offline, though its SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy. The page title, EmailLogin, directly correlates with the phishing scheme’s objective of mimicking authentication interfaces. Mitigation requires immediate action from both end users and network administrators. Users who may have interacted with this domain should reset credentials for any accounts accessed during the exposure window, prioritizing email and single-sign-on services. Multi-factor authentication should be enforced where available to neutralize stolen credentials. Network-level protections should include blocking the domain and its resolving IP (209.94.90.2) at firewalls and DNS resolvers. Organizations should audit logs for connections to the domain or IP, particularly from devices exhibiting anomalous authentication patterns. Given the domain’s historical registration date, further scrutiny of related infrastructure under the same registrar or IP range is warranted to identify potential lateral threats.