bafkreiahghyf2d37szl2h3mjae4aqbymgz7wsfv7wyn4aawr5ivlzqptzi[.]ipfs[.]dweb[.]link

This domain is flagged as an active credential theft operation targeting users through fraudulent email login interfaces. Analysis indicates the threat actor leverages the InterPlanetary File System (IPFS) gateway infrastructure to host a deceptive page titled EmailLogin, designed to harvest account credentials. The risk level is classified as high due to the domain's persistent activity and detection by multiple security mechanisms. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 209.94.90.2 and was originally created on February 24, 2017, under registrar CSC Corporate Domains, Inc. The SSL certificate is issued by Let's Encrypt, providing a veneer of legitimacy. Detection metrics show 18 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on two security blocklists. Additionally, the domain is actively blocked by PhishDestroy and OpenPhish, and holds a Gridinsoft trust score of 0/100, indicating a complete lack of credibility. Mitigation against this credential theft campaign requires immediate action from both end users and network administrators. Users should avoid interacting with any unsolicited email login prompts, particularly those hosted on decentralized storage networks like IPFS. Network-level protections should include blocking the resolved IP address 209.94.90.2 and implementing real-time URL filtering to prevent access to the domain. Organizations should also monitor for anomalous authentication attempts, as compromised credentials may be used for lateral movement or data exfiltration. Security teams are advised to treat any access attempts to this domain as indicators of compromise and initiate incident response protocols accordingly.