bafkreigpysgznoiy6tpehtfblhvkmg2vb3ihz2t3odeeqkrffv5tyalpwi[.]ipfs[.]dweb[.]link

This domain, hosted on an IPFS gateway, presents a credential theft threat by impersonating a legitimate sign-in portal. The page title 'Sign In' suggests an attempt to harvest user credentials, likely targeting corporate or financial service accounts. Infrastructure analysis reveals the domain is designed to mimic authentication flows, increasing the likelihood of successful compromise for unsuspecting visitors. Analysis indicates the domain is flagged by 19 out of 95 security vendors on VirusTotal, with one confirmed blocklist entry. Registered through CSC Corporate Domains, Inc. on February 24, 2017, the domain resolves to IP address 209.94.90.3 and uses a Let's Encrypt SSL certificate issued under the E8 intermediate. Despite its age, the domain remains active and continues to evade detection by a majority of security tools, highlighting its persistence as a threat. Users who have visited this domain should immediately revoke any entered credentials, particularly if reused across multiple platforms. Monitor associated accounts for unauthorized activity and enable multi-factor authentication where available. Network administrators are advised to block the domain and its resolving IP at the perimeter to prevent further exposure. If credentials were submitted, consider resetting passwords for all potentially affected accounts and reviewing connected devices for signs of compromise.