bafkreibl4x5xfafvwgt25syvoibbmu7wov5ojvacfcvd7hasfskqmca6dq[.]ipfs[.]dweb[.]link

This domain, bafkreibl4x5xfaf.ipfs.dweb.link, is identified as a generic phishing threat specializing in fake email login credential harvesting. Analysis indicates the page title explicitly reads 'EmailLogin,' suggesting an attempt to deceive users into submitting sensitive account information under false pretenses. The domain is currently offline, though prior activity confirms its malicious intent. Infrastructure analysis reveals the domain was flagged by 21 of 95 security vendors on VirusTotal, indicating broad detection despite its recent creation on April 25, 2026. Registered through CSC Corporate Domains, Inc., the domain resolves to the IP address 209.94.90.3, hosted by Protocol Labs in the United States. It appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (serial number E8). These technical indicators align with known phishing infrastructure patterns, particularly the use of IPFS for decentralized hosting to evade takedowns. The domain has since been taken offline, reducing immediate risk to users. However, organizations should remain vigilant, as similar threats often reappear under different identifiers. Concrete recommendations include blocking the resolved IP address (209.94.90.3) at the network level, monitoring for recurring phishing attempts using the same registrar or hosting provider, and educating users on recognizing fake login pages. Security teams should also review logs for prior interactions with this domain to assess potential credential exposure.