bafkreibissh3i2tnc3rjoib6paajb3zxlofc6j3tacdhjfk2txkj4ejxqm[.]ipfs[.]dweb[.]link

This domain, bafkreibissh3i2tnc3rjoib6paajb3zxlofc6j3tacdhjfk2txkj4ejxqm.ipfs.dweb.link, operates as a generic phishing infrastructure designed to harvest email login credentials. The page title "EmailLogin" indicates a focus on impersonating legitimate email authentication portals, likely targeting corporate or personal webmail users. The use of IPFS (InterPlanetary File System) via the dweb.link gateway suggests an attempt to leverage decentralized hosting for resilience against takedowns, a tactic increasingly observed in credential theft campaigns.

Analysis reveals multiple indicators of malicious intent. The domain was registered through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.3, hosted by Protocol Labs in the United States. It was created on April 27, 2026, and is currently offline. Detection metrics include 23 out of 95 security vendors flagging the domain on VirusTotal, while it appears on one security blocklist. The SSL certificate issued by Let's Encrypt (serial number E8) does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate.

Users who visited this domain or entered credentials should assume compromise. Immediate actions include resetting passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and monitoring for unauthorized activity. Network administrators should block the domain and associated IP address (209.94.90.3) at the perimeter. If the domain reappears under a different gateway or subdomain, it should be treated with the same elevated risk level due to the persistent nature of IPFS-hosted threats.