bafybeidumje7chffoznwpxhlkvbxzigm24d6g4ojc56i2w45uyh2fx63i4[.]ipfs[.]dweb[.]link

Analysis of the domain bafybeidumje7chffoznwpxhlkvbxzigm24d6g4ojc56i2w45uyh2fx63i4.ipfs.dweb.link indicates an active credential-phishing campaign targeting users of the Argent service. The domain, hosted on the InterPlanetary File System (IPFS) and resolving to 209.94.90.2 (AS40680, Protocol Labs, US), presents a page titled 'Sign in - Professional Email' and is explicitly categorized as brand impersonation of Argent. Infrastructure analysis reveals Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial E7), suggesting a structured deployment rather than opportunistic compromise. Detection data as of July 12, 2026, shows the domain is flagged by two security blocklists (PhishDestroy and PhishingDB) and is classified under 'SOCIAL_ENGINEERING' by Google Safe Browsing. Seventeen of ninety-five security vendors on VirusTotal have detected the domain as malicious. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., though this registration date may reflect the base dweb.link infrastructure rather than the specific phishing content. Technologies identified include IPFS, jQuery CDN, jQuery, Cloudflare, and HTTP/3, consistent with modern phishing kits designed for scalability and evasion. Defenders should treat this domain as high-risk due to its active status, confirmed brand impersonation, and detection by multiple security mechanisms. The use of IPFS and Cloudflare may complicate takedown efforts, requiring coordination with hosting providers and content delivery networks. Network-level blocking of 209.94.90.2 and associated IPFS gateways is recommended, alongside monitoring for similar dweb.link subdomains. The exact content and functionality of the phishing page remain unanalyzed; further investigation is required to determine if additional payloads or exfiltration methods are present.