bafkreigw7yly5hici6nqqjk3cpxi4iihqxzwp6llq5k6jxjmuglxhuqw74[.]ipfs[.]dweb[.]link

PhishDestroy identifies bafkreigw7yly5hici6nqqjk3cpxi4iihqxzwp6llq5k6jxjmuglxhuqw74.ipfs.dweb.link as a high-risk generic phishing site designed to steal login credentials. The page mimics a legitimate Zimbra Web Client Sign In portal, tricking users into entering their email and password. This domain does not provide any genuine Zimbra services and is actively used to harvest sensitive account information for malicious purposes.

This domain was flagged by 21 out of 95 VirusTotal security vendors, including OpenPhish and OISD blocklists. It resolves to IP 209.94.90.2 and was created on February 24, 2017. The domain is registered through CSC Corporate Domains, Inc., a legitimate registrar that has not suspended the site despite its malicious activity. The use of a Let's Encrypt SSL certificate adds a false sense of security, but the domain remains a verified threat.

If you visited this site and entered any credentials, change your passwords immediately and enable multi-factor authentication on all linked accounts. Scan your device for malware using reputable antivirus software, as phishing sites often deploy additional malicious payloads. Report the incident to your IT department or email provider if you used work-related or sensitive credentials. Avoid interacting with this domain entirely in the future, and use bookmarked links or verified URLs to access legitimate Zimbra or other service logins.