bafkreihaydjl7vi7elze6ytg6nh6j5weog7zvxpzvxkamtl2slxmtytwui[.]ipfs[.]dweb[.]link

PhishDestroy identifies this domain as an active generic phishing site posing an elevated credential theft risk. The infrastructure leverages IPFS (InterPlanetary File System) to host deceptive content, a technique increasingly exploited by threat actors to evade traditional blocklists. Users interacting with this domain may unknowingly expose login credentials, payment details, or sensitive personal data to attackers. The threat level is elevated due to the combination of active hosting, low detection rates, and the use of a legitimate-looking domain structure (dweb.link subdomain). Immediate avoidance is strongly advised. This domain was flagged by 8 out of 95 security vendors on VirusTotal, indicating limited but concerning recognition of its malicious nature. It resolves to the IP address 209.94.90.2, which has been associated with previous phishing campaigns. The domain was registered through CSC Corporate Domains, Inc., a reputable registrar that has been abused in the past for bulk malicious registrations. The SSL certificate, issued by Let's Encrypt, adds a false sense of legitimacy, as threat actors frequently exploit free certificates to appear trustworthy. Notably, the domain was created on February 24, 2017, suggesting a long-standing but recently active infrastructure, possibly repurposed for current campaigns. The low detection rate (8/95) and the absence of widespread blocklisting imply this domain is either newly weaponized or designed to fly under the radar. To mitigate risk, users should avoid interacting with this domain entirely. If access is unavoidable (e.g., for research purposes), use an isolated, non-production environment with no saved credentials or sensitive data. Security teams should block the domain at the network level via DNS sinkholing or firewall rules targeting the IP address (209.94.90.2) and the IPFS gateway (dweb.link). Additionally, inspect outbound traffic for POST requests to this domain, as phishing sites often exfiltrate stolen data to external endpoints. Consider reporting the domain to threat intelligence platforms and local CERT teams to aid in broader takedown efforts. For end-users, enabling multi-factor authentication (MFA) on all accounts and using password managers with phishing detection can reduce the impact of accidental credential exposure.