bafkreih6gdhqjxwbp4smbqvnoseqqcdyvvithchifzczh4inaji2ao7thu[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated-risk generic phishing threat specializing in fake email login credential harvesting. Analysis indicates the page title "EmailLogin" and infrastructure designed to mimic legitimate authentication portals, likely targeting corporate or personal email accounts to facilitate account takeover or subsequent phishing campaigns. Infrastructure analysis reveals the domain was registered on May 09, 2026, through CSC Corporate Domains, Inc., and resolves to IP address 209.94.90.3, hosted in the US under Protocol Labs. The domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its free availability. Organizations and users should implement the following mitigation steps: (1) Block the domain and its resolving IP (209.94.90.3) at the network perimeter; (2) Monitor for credential reuse attempts from harvested email accounts, particularly if the domain was previously accessed; (3) Educate users on identifying fake login pages, focusing on URL inspection and SSL certificate details; (4) Review logs for connections to the domain or IP prior to its takedown to assess potential exposure; (5) Report the domain to additional threat intelligence platforms to improve detection coverage across security tools.