bafkreigy5kskkesywu4u7wwn3na5lxxefvzog6mtos3hao73in7xe3ixl4[.]ipfs[.]dweb[.]link

This domain, bafkreigy5kskkesywu4u7wwn3na5lxxefvzog6mtos3hao73in7xe3ixl4.ipfs.dweb.link, is identified as an elevated-risk generic phishing threat designed to harvest user credentials through deceptive web interfaces. Analysis indicates the domain leverages IPFS decentralized hosting to evade takedowns, presenting a cloned or spoofed login portal typical of credential theft campaigns. The infrastructure is configured to mimic legitimate services, tricking users into submitting sensitive information such as usernames, passwords, or financial details under false pretenses. The domain's use of IPFS, a peer-to-peer storage network, complicates traditional mitigation efforts, as content remains accessible even after initial hosting nodes are disabled. Evidence supporting the classification includes detection by 19 out of 95 security vendors on VirusTotal, signaling broad consensus on its malicious nature. The domain was registered through CSC Corporate Domains, Inc. on February 21, 2026, an unusually future-dated creation that may indicate domain generation algorithm (DGA) abuse or registry manipulation. It appears on one security blocklist and is currently blocked by PhishDestroy, further corroborating its fraudulent intent. The domain resolves to IP address 209.94.90.3, hosted under AS40680 (Protocol Labs), a provider commonly associated with IPFS gateways. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. Users who visited this domain should immediately revoke any credentials entered on the site, as they are likely compromised. Reset passwords for all accounts accessed from the same device or network during the exposure window, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or transactions, and report any anomalies to the respective service providers. If the domain was accessed in a corporate environment, notify the security team to conduct a forensic review of the affected device for malware or persistent threats. Avoid interacting with any links or downloads from the domain, even if the site appears inactive, as residual payloads may remain.