bafkreiax55d5bmxagbpknmkwh72r33zxhddshkqwrxzpuljn3g365b2ohu[.]ipfs[.]dweb[.]link

This domain is flagged as a high-risk generic phishing threat targeting user credentials through an IPFS-hosted page titled EmailLogin. Analysis indicates the domain has been active since February 24, 2017, and currently resolves to the IP address 209.94.90.2. The infrastructure relies on Cloudflare and HTTP/3, with a Let's Encrypt SSL certificate providing encryption. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy, while VirusTotal reports detection by 18 out of 95 security vendors, suggesting moderate but not universal recognition of its malicious nature. The use of IPFS for hosting introduces persistence challenges, as content distributed via this protocol can remain accessible even if the original source is taken down. The page title, EmailLogin, implies an attempt to mimic legitimate email authentication portals, though no specific brand impersonation has been confirmed. The domain's registration through CSC Corporate Domains, Inc. aligns with patterns observed in both legitimate and malicious infrastructure, offering no definitive attribution on its own. Defenders should prioritize blocking the domain and its resolving IP address at the network level, particularly in environments where IPFS traffic is permitted. Monitoring for similar IPFS-based phishing attempts is recommended, as this method of hosting can evade traditional takedown mechanisms. Given the domain's age and continued activity, it may serve as part of a broader campaign rather than an isolated incident. No evidence currently links this domain to a known phishing kit or specific threat actor, leaving the exact origin and intent uncertain.