bafybeicsvg3dgezrwcxqyyymle3vkuxlx62jm6sulb6wzfz3mvp3bng2ee[.]ipfs[.]dweb[.]link

This domain, bafybeicsvg3dgezrwcxqyyymle3vkuxlx62jm6sulb6wzfz3mvp3bng2ee.ipfs.dweb.link, is flagged as a generic phishing threat designed to mimic the Naver login portal. The page title "네이버 : 로그인" confirms intent to harvest Korean-language user credentials through a fraudulent interface. No specific drainer kit signatures were identified, but the IPFS-hosted infrastructure and Let's Encrypt SSL certificate align with common phishing deployment patterns. Analysis indicates the domain resolves to 209.94.90.3 (US, AS40680 Protocol Labs) and was registered through CSC Corporate Domains, Inc. on February 21, 2026. VirusTotal detection reached 19/95 security vendors, while the domain appears on two security blocklists. The SSL certificate (Let's Encrypt / E7) was issued to support HTTPS encryption, a tactic used to increase legitimacy perception. Creation date anomalies suggest potential domain spoofing or incorrect registry data. The domain is currently offline, having been taken down following detection. Response actions included blocking by PhishDestroy and PhishingDB, though residual risk remains due to the IPFS-based hosting model, which allows rapid redeployment. Users who accessed the page should assume credential exposure and initiate password resets on Naver accounts. Network defenders should monitor for related IPFS hashes or reused infrastructure patterns.