bafybeifk4ns4njv6aax6j6re76ehsfljl6mz4z5kadqsuew27snjarnvwu[.]ipfs[.]w3s[.]link

This domain is an active credential-harvesting phishing site operating through an IPFS gateway. The page mimics legitimate login portals to capture usernames, passwords, and other sensitive authentication details. Users who interact with the site risk immediate credential theft, which may lead to unauthorized account access, financial fraud, or further targeted attacks using stolen information. The site employs social engineering tactics to deceive visitors into submitting personal data under false pretenses, such as fake security alerts or account verification prompts. Analysis indicates the domain was registered on April 27, 2026, through 1API GmbH, a registrar commonly used for both legitimate and malicious infrastructure. As of the latest scan, 12 out of 95 security vendors on VirusTotal have flagged the domain as malicious, with detections categorized under generic phishing and social engineering. The domain resolves to the IP address 104.18.41.169, which is associated with Cloudflare’s network, a frequent choice for threat actors to mask origin servers and evade takedowns. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. If a user has visited this domain or entered credentials, immediate action is required. First, revoke any entered credentials by changing passwords for all potentially compromised accounts, prioritizing financial, email, and work-related services. Enable multi-factor authentication (MFA) where available, using app-based or hardware tokens instead of SMS. Monitor accounts for unauthorized activity, including logins, transactions, or password reset attempts. Check connected devices for malware, as phishing sites may redirect to exploit kits or prompt downloads of malicious payloads. Report the incident to internal security teams or relevant authorities, and consider submitting the domain to additional threat intelligence platforms to improve detection coverage.