bafybeibt7gvufsgdp3colbyw7ax6k6zl7hra6uebf3bfwhjmop5h76geki[.]ipfs[.]dweb[.]link

This domain is flagged as an elevated risk due to its involvement in credential theft phishing activities. The domain, hosted on the IPFS network and resolving to the IP address 209.94.90.2, was designed to impersonate a Webmail service to deceive users into submitting their credentials. The elevated risk level is attributed to its capacity to exploit user trust in legitimate-looking interfaces to harvest sensitive information.

Analysis indicates that the domain was registered through CSC Corporate Domains, Inc. and was created on March 08, 2026. It has been taken offline, but during its active period, it was flagged by 18 out of 95 security vendors on VirusTotal. The domain appears on at least two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate was issued by Let's Encrypt, which is often used for legitimate encryption but can also be misused by threat actors for phishing sites.

To mitigate risks associated with credential theft, users and organizations should implement multi-factor authentication on all webmail services to reduce the impact of compromised credentials. Regularly update and educate users about recognizing phishing attempts, particularly those that mimic common services like webmail. Security teams should ensure that domain monitoring and blocking of known malicious domains are part of their defensive strategy. Additionally, integrating threat intelligence feeds to automatically update blocklists can help preemptively protect against such threats.