bafkreidzucisbrwkihjcbqdjbykcvgrsqgcypgdpqdnoc3ueck7f7fk75e[.]ipfs[.]dweb[.]link

Analysis of the domain bafkreidzucisbrwkihjcbqdjbykcvgrsqgcypgdpqdnoc3ueck7f7fk75e.ipfs.dweb.link indicates it was actively involved in credential phishing operations targeting email login credentials, as evidenced by the page title 'EmailLogin' and its classification as a credential phishing scam. The domain, registered through CSC Corporate Domains, Inc. on February 24, 2017, resolved to the IP address 209.94.90.2, hosted on AS40680 Protocol Labs infrastructure in the United States. It utilized Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and was secured with a Let's Encrypt SSL certificate (E8), which is common among both legitimate and malicious sites. Infrastructure analysis reveals the domain was flagged by 17 of 91 security vendors on VirusTotal, though the specific detection logic remains unverified.

It also appeared on at least one security blocklist and was blocked by PhishDestroy, further corroborating its malicious classification. Gridinsoft assigned a trust score of 0/100, reinforcing its elevated risk status. The domain returned an HTTP 410 status code, indicating it has been intentionally taken offline, though residual risk may persist if cached or archived versions remain accessible. Defenders should treat this domain as a confirmed phishing threat, particularly for credential harvesting.

Network-level blocking is recommended, along with monitoring for related infrastructure reuse, such as the IP address or nameserver pair. While the exact brand or service being impersonated is not specified in available data, the page title suggests a focus on email login portals. No evidence links this domain to a specific phishing kit or broader campaign, and further forensic analysis would be required to determine its operational scope or actor attribution.