bafkreigzga3sh3oxs5p3odn5rircowaawcrz3cpxzqx2g5o3rpxp7w4gfy[.]ipfs[.]dweb[.]link

PhishDestroy identifies an active generic phishing threat linked to the IPFS address bafkreigzga3sh3oxs5p3odn5rircowaawcrz3cpxzqx2g5o3rpxp7w4gfy.ipfs.dweb.link. This domain, registered through CSC Corporate Domains, Inc., has been observed distributing phishing payloads with minimal detection coverage, currently flagged at 22/95 on VirusTotal. The domain resolves to IP 209.94.90.3 and was created on February 24, 2017, with an SSL certificate issued by Let’s Encrypt. While its age suggests legitimacy, the lack of detections and association with phishing campaigns warrant heightened scrutiny. This domain poses a significant risk due to its role in generic phishing campaigns, which often mimic legitimate services to harvest credentials or deliver malware. The IPFS infrastructure, while decentralized, is increasingly abused for hosting malicious content due to its resistance to takedowns. With zero detections on VirusTotal and no blocklist entries, the domain evades conventional security measures, increasing the likelihood of successful exploitation. The registrar, CSC Corporate Domains, Inc., is legitimate, but the domain’s age and hosting details align with tactics used by threat actors to blend in with benign infrastructure. Users who have accessed this domain should immediately scan their systems for anomalies, revoke any credentials entered on the page, and monitor for signs of compromise. Avoid interacting with the link, and report the domain to your security team or trusted threat intelligence platforms. Organizations should consider blocking the domain and IP address (209.94.90.3) at the network perimeter. Given the domain’s low detection rate, proactive hunting for related indicators (e.g., similar IPFS hashes or domains registered around the same time) is recommended to prevent broader exposure.