bafkreibh53t73kz5qwnmfjieva3j3ksdhbltthzlpjys33iws3uryri3vy[.]ipfs[.]dweb[.]link

Analysis of the domain bafkreibh53t73kz5qwnmfjieva3j3ksdhbltthzlpjys33iws3uryri3vy.ipfs.dweb.link shows an active generic phishing campaign classified as credential phishing. The domain was created on June 12, 2026 and resolves to IP address 209.94.90.3, which is geolocated to the United States and associated with Protocol Labs infrastructure. Registration was performed through CSC Corporate Domains, Inc., and the authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, indicating Cloudflare hosting. Technical fingerprints include the use of IPFS, Cloudflare services, and HTTP/3, with a valid Let's Encrypt (E8) TLS certificate. VirusTotal reports 18 of 91 security vendors flagging the domain, and the site is already blocked by PhishDestroy. The HTTP response code is 200, the page title returned is "EmailLogin", and Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist. No additional content analysis is available beyond the title, and no specific brand target is identified. Defenders should immediately block the domain and its associated IP at perimeter firewalls, DNS resolvers, and email gateways. Continuous monitoring of the IP address for related activity is advised, as is inclusion of the domain in threat intelligence feeds and internal blocklists. Given the low trust score and existing blocklist entries, the risk to credential security is high, and remediation actions should be prioritized.