bafkreignr7h7nn2z6macmycdjjva4jq3rcwrcu4aidh3hsmu4iywvmt6bq[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreignr7h7nn2z6macmycdjjva4jq3rcwrcu4aidh3hsmu4iywvmt6bq.ipfs.dweb.link as an active generic phishing domain impersonating login portals to harvest user credentials. The page title 'EmailLogin' suggests a spoofed webmail service, likely mimicking enterprise or corporate email systems to deceive victims into entering their credentials. No specific drainer kit (e.g., crypto wallet drainers) was identified, but the generic nature of the phishing page indicates a broad targeting approach rather than a brand-specific campaign.

This domain exhibits multiple red flags. It was registered via CSC Corporate Domains, Inc., and resolution leads to IP 209.94.90.3. The domain was created on February 24, 2017, which is unusual for modern phishing infrastructure, suggesting a long-term but recently repurposed asset. Security vendor detection stands at 15/95 on VirusTotal, indicating partial but not universal recognition. It is flagged by OpenPhish and OISD, and appears on two security blocklists. This domain also holds a Let's Encrypt SSL certificate, which may be used to lend an air of legitimacy to the phishing page.

As of current analysis, this phishing domain remains active despite multiple blocklist inclusions and partial vendor detection. Immediate remediation includes blocking the domain at DNS and network levels, and flagging the associated IP 209.94.90.3 for traffic inspection. The primary risk is credential harvesting for unauthorized access to email accounts, which may lead to further compromise including lateral movement in corporate networks, data exfiltration, or follow-on phishing from the compromised account. Users should avoid accessing this domain entirely and report it via their internal threat intelligence channels. While the domain shows signs of aging infrastructure, its active use and partial evasion of detection mechanisms make it a continuing threat requiring ongoing monitoring and containment.