bafkreid4xdvobhgxfqpzn6fkes5hpweukdmvzpyjh4hsvf5ag4evgllnfa[.]ipfs[.]dweb[.]link

PhishDestroy identifies a high-risk phishing page disguised as a Webmail login portal, deployed on the InterPlanetary File System (IPFS) gateway dweb.link. This impostor site masquerades as a corporate email sign-in screen and is engineered to harvest login credentials or seed phrases without the user’s knowledge. Once entered, any submitted information can be immediately exploited by attackers to drain cryptocurrency wallets or gain unauthorized access to email and connected accounts. This is not a legitimate login page—it is a live credential-harvesting trap actively collecting user data. This domain was flagged on 18 of 95 VirusTotal security engines, has been active since February 24, 2017, and is currently resolving to IP address 209.94.90.2. It is registered through CSC Corporate Domains, Inc., and is blocked by the OpenPhish blocklist for hosting a crypto drainer masquerading as a Webmail sign-in. The SSL certificate is issued by Let’s Encrypt, giving it a false appearance of legitimacy. If you visited this page, do NOT enter any login credentials, email address, or cryptocurrency wallet information. Disconnect from the internet, clear browser cache and cookies, and run a full antivirus scan. Change passwords for sensitive accounts only after verifying the legitimacy of login portals through official channels. Report the incident to your IT team or PhishDestroy for further analysis. Never reuse passwords across services, especially for email and financial accounts.