The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Phishing detected
| URL | hxxp://bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le[.]ipfs[.]dweb[.]link/ | |
| Host | bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le[.]ipfs[.]dweb[.]link | |
| Registered domain | dweb[.]link | |
| Scan ID | 758eb7a4-e44f-4a1b-a0dd-bfd858850080 |
No brand impersonation signals available.
| Host | bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le.ipfs.dweb.link |
| Registered domain | dweb.link |
| Scheme | http |
| ApiFlash | Error fetching data |
| JARM | 0d39b39b30d30d37d20320327d20122de7c02fe862e334985aa656e5df0651 |
| Redirect hops | 2 |
The page presents itself as a generic “EmailLogin” / “Secure Mail Server” login, but it is hosted on an IPFS dweb link with a randomized identifier. It includes credential-harvesting UX: a visible “Email:” field label and a “pаsswоrd” label plus an instruction/error message (“Please enter your mailbox pаsswоrd to continue.”), all inside a login form.
Key phishing signals include:
-
Suspicious URL/domain:
...ipfs.dweb.link/with a long hash-like subdomain is not associated with any legitimate email/security provider. -
Credential capture: presence of password-entry prompt strongly indicates a fake login intended to collect credentials (even though the simplified HTML shows
onsubmit="return false;"). - Obfuscation in text: “pаsswоrd” uses Cyrillic characters (homoglyphs), a common technique to evade detection and confuse users.
- No verifiable brand: the page does not match any known provider’s branding or domain.
Because the page impersonates an email login flow without belonging to a legitimate provider’s domain, the likelihood of phishing is very high.