bafkreibvxrulpdmmdgyhohk3x76ukl6izgad5kmliledw77ro64lxp7k6i[.]ipfs[.]dweb[.]link

Analysis of the domain bafkreibvxrulpdmmdgyhohk3x76ukl6izgad5kmliledw77ro64lxp7k6i.ipfs.dweb.link indicates an elevated-risk credential phishing campaign targeting Network Solutions. The domain, created on February 24, 2017, is registered through CSC Corporate Domains, Inc., and currently resolves to the IP address 209.94.90.2, located in the United States under AS40680 (Protocol Labs). Infrastructure analysis reveals the use of Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and HTTP/3 technology, alongside a Let's Encrypt SSL certificate (E7). The page title, 'Sign in - Professional Email,' aligns with the reported scam type of credential phishing, specifically impersonating Network Solutions.

At the time of this report, the domain returns an HTTP 410 status, indicating it has been taken offline. However, prior to its removal, the domain was flagged by 14 of 93 security vendors on VirusTotal and appears on at least one security blocklist, with PhishDestroy specifically blocking it. The combination of brand impersonation, credential phishing indicators, and detection by multiple security vendors underscores the elevated risk level.

Defenders are advised to monitor for residual DNS caching, review logs for prior access attempts, and update blocklists to include this domain and associated infrastructure. The exact content and phishing kit used remain unconfirmed, as no detailed forensic analysis of the page has been conducted. Further investigation into the hosting provider and registrar may reveal additional linked domains or campaigns.