bafkreidvxyed6inubotjxgjmci4yhlfog34ea4jh5mtllezn6k57orcxvy[.]ipfs[.]dweb[.]link

This domain, bafkreidvxyed6inubotjxgjmci4yhlfog34ea4jh5mtllezn6k57orcxvy.ipfs.dweb.link, is actively flagged as a high-risk brand impersonation threat targeting generic email services. Analysis indicates the domain was registered on February 24, 2017, through a corporate registrar, yet its current use aligns with malicious activity rather than legitimate hosting. The page title, Webmail Portal Login, explicitly suggests an attempt to mimic email login interfaces, a common tactic for credential harvesting. Infrastructure analysis reveals the domain resolves to the IP address 209.94.90.3 and employs technologies such as IPFS, Cloudflare, and HTTP/3, which are frequently leveraged to obscure origin and evade detection. Security vendors have flagged this domain with notable consistency: 18 out of 95 engines on VirusTotal classify it as malicious, and it appears on two security blocklists. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate the legitimacy of the content. While the domain's age might suggest stability, its inclusion in threat intelligence feeds and low trust scores from Gridinsoft and Scamadviser (0/100 and 1/100, respectively) reinforce its classification as a high-risk asset. What remains uncertain is the exact scale of the campaign and whether the domain is part of a broader infrastructure. The use of IPFS, a decentralized storage system, complicates takedown efforts and attribution, as content may persist even after domain suspension. Defenders should prioritize blocking this domain at the network level, particularly in environments where email credentials are critical. Monitoring for connections to the resolving IP address, 209.94.90.3, may also help identify related threats or compromised endpoints. Given the domain's active status and clear impersonation intent, immediate action is recommended to mitigate potential credential theft or lateral movement within networks.