bafkreighdzwwvje2ziuphcw7jpnerrgckkrecgjzaivht3gqp3a6k2cerm[.]ipfs[.]dweb[.]link

PhishDestroy identifies an active Email credentials phishing campaign hosted on bafkreighdzwwvje2ziuphcw7jpnerrgckkrecgjzaivht3gqp3a6k2cerm.ipfs.dweb.link. The fraudulent landing page is titled EmailLogin and mimics a legitimate webmail login interface to harvest user credentials. This high-risk threat is designed to trick victims into entering their email login details into a controlled interface, enabling threat actors to intercept passwords and session tokens for further exploitation. This domain was flagged by 17 out of 95 VirusTotal security vendors, indicating significant detection across major antivirus engines. It was registered through CSC Corporate Domains, Inc. and resolves to IP address 209.94.90.2. The domain was created on February 24, 2017, and currently remains active with a valid Let's Encrypt SSL certificate. These factors combined suggest a long-term infrastructure leveraged for deception, with consistent hosting despite its detection history. To mitigate exposure, users should avoid accessing this domain or any IPFS-linked pages prompting login credentials. Organizations are advised to block the IP address 209.94.90.2 and the domain using DNS and firewall rules. Enable multi-factor authentication on all email accounts to reduce the impact of credential theft. Report any interactions with this page to your security team and update threat intelligence feeds to prevent further propagation.