bafkreiaziuicwhwde6ysxzks4udfr5ud4mutnde32ra26vq5zulhidoqaq[.]ipfs[.]dweb[.]link

This domain, bafkreiaziuicwhwde6ysxzks4udfr5ud4mutnde32ra26vq5zulhidoqaq.ipfs.dweb.link, is flagged as an active high-risk credential phishing threat. Infrastructure analysis reveals it is hosted on IPFS and resolves to 209.94.90.3, with Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com) and a Let's Encrypt SSL certificate. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and is currently active with a page title of 'EmailLogin,' indicating a focus on harvesting email credentials. Security vendors have detected malicious activity: 20 of 91 engines on VirusTotal flag this domain. It appears on one security blocklist and is blocked by at least one threat intelligence provider. Technologies in use include IPFS, Cloudflare, and HTTP/3, which may aid in evading detection or takedown efforts. The exact content of the phishing page is not yet analyzed, but the 'EmailLogin' title suggests a generic credential harvesting scheme rather than a brand-specific impersonation. Defenders should treat this domain as an active threat. Immediate actions include blocking resolution at DNS and network levels, monitoring for connections to 209.94.90.3, and reviewing logs for interactions with the domain. Given its IPFS hosting, traditional takedown methods may be less effective, requiring coordination with hosting providers or certificate authorities. No specific brand impersonation is confirmed, but the credential phishing classification warrants heightened scrutiny for any email-related login attempts originating from this infrastructure.