bafkreiezz7szm2v5hdurd4odopuw42wyqmyqeo4kmdafhzuhdqmshljdpa[.]ipfs[.]dweb[.]link

This domain hosts a generic phishing page designed to mimic a Professional Email login portal. The page title, 'Sign in - Professional Email,' suggests an attempt to harvest credentials by impersonating legitimate enterprise email services. Infrastructure analysis reveals the domain is hosted on IPFS via the dweb.link gateway, a common tactic to evade takedowns and obscure hosting origins. The phishing page targets users expecting corporate or organizational email access, increasing the likelihood of successful credential theft from unsuspecting employees or contractors.

Evidence indicates the domain is flagged by 20 out of 95 security vendors on VirusTotal, reflecting a moderate to high confidence level in its malicious nature. Registered through CSC Corporate Domains, Inc. on February 24, 2017, the domain predates the observed phishing activity, suggesting potential compromise or repurposing of existing infrastructure. It appears on two security blocklists, including PhishDestroy and PhishingDB, and resolves to the IP address 209.94.90.3, associated with AS40680 (Protocol Labs). The SSL certificate, issued by Let's Encrypt (serial E7), does not mitigate the threat, as phishing domains frequently use valid certificates to appear legitimate.

Users who visited this domain should immediately reset any credentials entered on the page, particularly those associated with corporate or professional email accounts. Organizations should monitor for unauthorized access attempts or anomalous login activity originating from the affected accounts. If the domain was accessed via a corporate device, a full security scan is recommended to detect potential malware or backdoors. Network administrators should block the domain and its resolving IP (209.94.90.3) at the perimeter to prevent further exposure. Additionally, users should verify the legitimacy of any unexpected email login prompts by contacting their IT or security team directly.