bafkreifjwfze2ce74zbj6xilrzf3wixlub5w7ixt2iofzkd72vtndj7c2a[.]ipfs[.]dweb[.]link

This domain is flagged as a high-risk credential phishing infrastructure targeting users through deceptive login portals. Analysis indicates the site mimics legitimate authentication pages to harvest usernames, passwords, and session tokens, often distributed via malicious links in emails, instant messages, or compromised advertisements. The threat leverages IPFS-based hosting to evade traditional takedown mechanisms, increasing persistence and complicating mitigation efforts for network defenders. Infrastructure analysis reveals the domain was registered on June 08, 2026, through CSC Corporate Domains, Inc., a registrar frequently observed in phishing campaigns due to its bulk registration capabilities. As of the latest assessment, the domain appears on one security blocklist and is flagged by 16 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. The use of a decentralized web link (dweb.link) further suggests an attempt to exploit peer-to-peer hosting for resilience against conventional domain suspension techniques. Users who have interacted with this domain should immediately revoke any entered credentials, particularly for financial, email, or enterprise services. Network administrators are advised to block the domain at the perimeter and monitor for indicators of compromise, including unusual outbound connections to IPFS gateways or unexpected authentication attempts. Affected systems should undergo a full security review, including checking for unauthorized access, malware infections, or lateral movement within the network. If multi-factor authentication (MFA) was not enabled, users should enable it immediately and rotate all potentially exposed credentials using a secure, isolated device.