bafkreia7m7wyi7xnltk5kqkoy4m3nssthp2vnjertouskbhqknycjtb2o4[.]ipfs[.]dweb[.]link

This domain is flagged as a high-risk credential theft portal designed to harvest email account credentials. Analysis indicates the threat specifically targets users through an interface titled 'EmailLogin,' suggesting a focus on unauthorized access to personal or corporate email systems. The infrastructure remains active, posing an immediate risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on June 08, 2026, through CSC Corporate Domains, Inc. and currently resolves to IP address 209.94.90.3. The SSL certificate is issued by Let's Encrypt (serial number E8), a common tactic to lend false legitimacy. Security vendors on VirusTotal detect this domain at 18/95, while it appears on one security blocklist and is specifically blocked by PhishDestroy. The creation date discrepancy (future-dated) further suggests malicious intent, as threat actors often manipulate registration details to evade detection. Mitigation against this credential theft portal requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP (209.94.90.3) at the firewall or DNS level to prevent access. End users must verify the legitimacy of any email login page, particularly those hosted on decentralized networks like IPFS, which are increasingly exploited for phishing. Multi-factor authentication (MFA) should be enforced for all email accounts to limit the impact of stolen credentials. Security teams are advised to monitor for connections to 209.94.90.3 and correlate with authentication logs to identify potential compromise.