bafkreiboaccm7y6rg75nx4xm33zwuqctshqrqetk5yasu6jcsiqda4gqwq[.]ipfs[.]dweb[.]link

This domain, part of the IPFS decentralized web gateway, is flagged as a high-risk credential-phishing site targeting email logins. Analysis indicates the domain was registered on May 6, 2026, through CSC Corporate Domains, Inc., and remains active as of July 12, 2026. The page title 'EmailLogin' suggests a focus on harvesting email credentials, though the exact content or targeted brands are not confirmed in available data. The domain resolves to IP 209.94.90.3, hosted under Protocol Labs in the US, and uses Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com). Security vendors have detected malicious activity: 21 of 91 engines on VirusTotal flagged the domain. The SSL certificate is issued by Let's Encrypt (serial E8), which is consistent with both legitimate and malicious sites. The domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, reinforcing its classification as high-risk. Defenders should treat this domain as an active threat. Block access at the network level, particularly for endpoints where email credentials are critical. Monitor for connections to 209.94.90.3 or the domain itself in proxy logs. If internal users accessed the site, initiate credential reset procedures for affected accounts. Further analysis of the site's content may reveal additional indicators, but current data supports immediate containment actions.