bafkreifzxboga62232x5lwfn74y225ts5nx3f5pp2ffq5x7pp5yx7mwscu[.]ipfs[.]dweb[.]link

Analysis indicates that the domain bafkreifzxboga62232x5lwfn74y225ts5nx3.ipfs.dweb.link is actively serving a generic phishing campaign as of July 12, 2026. The domain resolves to the IP address 209.94.90.2 and presents a page titled EmailLogin, suggesting an attempt to harvest email credentials. Infrastructure analysis reveals the domain was registered on April 27, 2026, through CSC Corporate Domains, Inc., with a Let's Encrypt SSL certificate in place, which is commonly observed in both legitimate and malicious sites. Detection data shows that 17 of 95 security vendors on VirusTotal have flagged this domain, while Gridinsoft assigns it a trust score of 0 out of 100. The domain appears on at least one security blocklist and is currently blocked by PhishDestroy. Technologies detected include IPFS for decentralized hosting, Cloudflare for traffic routing, and HTTP/3 for improved performance, which may complicate takedown efforts. The exact content and targeting of the phishing page remain unconfirmed, as no brand-specific indicators or phishing kit signatures have been identified in the available data. Defenders should treat this domain as high-risk and prioritize blocking access at the network level, particularly in environments where credential harvesting poses a significant threat. Further analysis of the page content is recommended to determine the specific tactics employed and any targeted brands or services.