bafkreifadjauwuusvgltehytvdkursc6ekvbyfnxkzj6br24giicg4kajy[.]ipfs[.]dweb[.]link

This domain, bafkreifadjauwuusvgltehytvdkursc6ekvbyfnxkzj6br24giicg4kajy.ipfs.dweb.link, poses an elevated-risk brand impersonation threat targeting Rackspace customers. The domain mimics the official Rackspace Webmail login interface, specifically displaying the page title 'Rackspace Webmail: Hosted Email for Business.' Such impersonation is typically used to harvest corporate credentials, enabling unauthorized access to hosted email accounts, sensitive communications, and internal business data. The use of a decentralized web link (IPFS) adds a layer of obfuscation, complicating takedown efforts and allowing threat actors to rapidly redeploy malicious content under different hashes while maintaining a consistent phishing infrastructure. Analysis indicates the domain was registered through CSC Corporate Domains, Inc., with a creation date of February 21, 2026, suggesting either a typo-squatting attempt or a preemptive registration for future malicious use. The domain resolves to the IP address 209.94.90.3, hosted on AS40680 (Protocol Labs) in the United States. It is currently flagged by 20 out of 95 security vendors on VirusTotal, and appears on one security blocklist, specifically PhishDestroy. The SSL certificate is issued by Let's Encrypt (serial number E7), which, while legitimate, is frequently exploited by threat actors to lend credibility to phishing pages. The domain has since been taken offline, but its infrastructure remains a potential vector for re-emergence under a different IPFS hash or subdomain. Users who accessed this domain should assume their credentials were compromised. Immediate actions include resetting passwords for all Rackspace-associated accounts, enabling multi-factor authentication (MFA) if not already in place, and reviewing account activity for unauthorized access or suspicious email forwarding rules. Organizations should also monitor for signs of lateral movement, such as unusual login attempts or data exfiltration from compromised accounts. Network administrators are advised to block the IP address 209.94.90.3 and the domain bafkreifadjauwuusvgltehytvdkursc6ekvbyfnxkzj6br24giicg4kajy.ipfs.dweb.link at the firewall or proxy level to prevent future access. Additionally, endpoint detection and response (EDR) systems should be updated to flag any connections to IPFS-based domains impersonating known brands, particularly those leveraging Let's Encrypt certificates for SSL encryption.