bafkreiac2jv3nypiod3oolnpoj4sz4xqchyh3n4miy6wbmwj23yrn7ksnm[.]ipfs[.]dweb[.]link

Analysis indicates the domain bafkreiac2jv3nypiod3oolnpoj4sz4xqchyh3n4miy6wbmwj23yrn7ksnm.ipfs.dweb.link is an active high-risk phishing site targeting user credentials. The page title 'EmailLogin' suggests a generic login-themed phishing attempt, though the exact brand or service being impersonated remains unconfirmed as no specific brand target is identified in available data. Infrastructure analysis reveals the domain resolves to 209.94.90.3, hosted under Protocol Labs in the United States, with Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com). The domain was registered on May 14, 2026, through CSC Corporate Domains, Inc., and currently holds a valid Let's Encrypt SSL certificate (E8). Security vendors have flagged this domain, with 14 of 92 engines detecting malicious activity, and it appears on at least one security blocklist. The site returns an HTTP 200 status, confirming it is operational as of July 12, 2026. Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting. While the specific phishing kit or campaign details are not yet analysed, the combination of a login-themed page, recent registration, and detection by multiple security sources justifies immediate blocking and monitoring. No evidence suggests this domain is associated with legitimate services, and users should avoid interaction until further analysis is conducted.