bafkreihtqnzk5fy34v72ozhiwchifj3cakrye2maw5bpdg3gl5l6q4o33e[.]ipfs[.]dweb[.]link

This domain is flagged for elevated-risk credential theft activity, specifically designed to impersonate legitimate login portals and harvest user credentials. Analysis indicates the page title 'Sign In.' aligns with common phishing tactics targeting authentication flows, where victims unknowingly submit sensitive information to attacker-controlled infrastructure. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain, bafkreihtqnzk5fy34v72ozhiwchifj3cakry.ipfs.dweb.link, is registered through CSC Corporate Domains, Inc., and resolves to IP address 209.94.90.2 (AS40680 Protocol Labs, US). It was created on February 24, 2017, but recent malicious activity has been detected. Security vendors on VirusTotal flagged the domain at a rate of 19/95, while it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (E7), a common choice for both legitimate and malicious sites due to its accessibility. To mitigate credential theft risks associated with this domain, organizations should immediately block access to the URL and its resolving IP address (209.94.90.2) at the network perimeter. End-users should be educated on recognizing phishing attempts, particularly those mimicking login pages, and encouraged to verify domain authenticity before entering credentials. Security teams should monitor for unauthorized access attempts originating from credentials potentially compromised through this campaign, and enforce multi-factor authentication to reduce the impact of stolen credentials. Given the domain's current offline status, further investigation into related infrastructure is recommended to identify any residual threats.