bafkreiaiifyr4jetebbes6gloc2hbuwix3gf5zth6pri2sjupwmma7jrwm[.]ipfs[.]dweb[.]link

The domain bafkreiaiifyr4jetebbes6gloc2hbuwix3gf5zth6pri2sjupwmma7jrwm.ipfs.dweb.link is involved in a credential phishing scheme. It has been flagged as malicious by 20 out of 91 vendors on VirusTotal, indicating a significant threat level. The domain was registered through CSC Corporate Domains, Inc. and hosted on an IP address managed by Protocol Labs in the US. The SSL certificate was issued by Let's Encrypt, which is commonly used due to its free and automated nature.

The phishing operation targeted users by mimicking an email login page, aiming to harvest sensitive credentials. Despite its current offline status, the domain was active enough to be placed on one public blocklist, specifically flagged by PhishDestroy. The domain was first detected on the same day it was created, April 26, 2026, showcasing the rapid deployment typical of phishing campaigns.

PhishDestroy's early detection highlights the importance of swift identification in the fight against phishing. This domain's rapid takedown underscores the effectiveness of coordinated efforts between security platforms and hosting providers. The platform risk score of 73 out of 100 suggests a high level of threat during its active period. This case exemplifies the need for continuous monitoring and quick response to emerging phishing threats.