bafkreibjfpmextex4uxucejwm4huyvvlgattxhddtqio4cmj3h4zafhzzu[.]ipfs[.]dweb[.]link

The domain bafkreibjfpmextex4uxucejwm4huyvvlgattxhddtqio4cmj3h4zafhzzu.ipfs.dweb.link is currently active and classified as a high‑risk generic phishing infrastructure. It was registered on May 14, 2026 through CSC Corporate Domains, Inc. and resolves to IP address 209.94.90.3, which is geolocated to the United States and associated with Protocol Labs. The site serves HTTP 200 responses and presents the page title "Webmail," indicating a credential‑collection intent. TLS is provided by a Let’s Encrypt certificate (E8). DNS is hosted on Cloudflare name servers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. VirusTotal analysis shows 18 of 92 security vendors flag the domain, and an independent Gridinsoft assessment assigns a trust score of 0/100. While the exact phishing kit and targeted brands are not disclosed, the evidence points to a credential‑phishing campaign. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP, and update detection rules to flag any traffic to the identified IP or TLS certificate fingerprint. Continuous monitoring is advised to capture potential evolution of the payload or additional infrastructure linked to this seed (997789).