bafkreicyghdtqspqrperjhwyfum7blmddcsnbeegsm5n46dfjkgypjcste[.]ipfs[.]dweb[.]link

The domain bafkreicyghdtqspqrperjhwyfum7blmddcsnbeegsm5n46dfjkgypjcste.ipfs.dweb.link resolves to IP 209.94.90.2, an address registered to a US entity associated with Protocol Labs. The site presents a page titled "EmailLogin" and serves content over HTTPS using a Let’s Encrypt certificate (E8). Registration data shows the domain was created on February 24 2017 through CSC Corporate Domains, Inc. Security telemetry indicates the domain is currently active and has been flagged by 20 of 91 vendors on VirusTotal, while Gridinsoft assigns a trust score of 0 / 100. It is listed on one public blocklist and has been blocked by the PhishDestroy filtering service. The observed characteristics align with a credential‑phishing campaign targeting email credentials. Uncertainty remains around the specific phishing kit or any downstream infrastructure, as no additional indicators such as payload hashes or related command‑and‑control hosts have been disclosed. Defenders should prioritize blocking the domain and its resolved IP at perimeter and endpoint layers, enforce strict URL filtering for the ipfs.dweb.link suffix, and monitor TLS certificate changes for the Let’s Encrypt issuance. Continuous threat‑intel feeds should be consulted for any new detections linked to this IP or associated registrant, and incident response teams should be prepared to investigate credential‑theft attempts that reference the "EmailLogin" page title.