bafkreia2wkoizc7t42gtd3e76kklkp545ze6hr4gf6pji7fznqo3hibqqm[.]ipfs[.]dweb[.]link

This domain, bafkreia2wkoizc7t42gtd3e76kklkp545ze6hr4gf6pji7fznqo3hibqqm.ipfs.dweb.link, is flagged as a high-risk generic phishing threat targeting email credentials. Analysis indicates the domain was registered on April 26, 2026, and currently resolves to the IP address 209.94.90.2, hosted by Protocol Labs in the United States. The page title, EmailLogin, suggests an attempt to mimic legitimate email authentication portals, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the use of Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and HTTP/3, which may be leveraged to obscure malicious traffic or evade detection. The domain is actively blocked by one security vendor and appears on a single blocklist, though VirusTotal reports 15 out of 95 security vendors flagging it as malicious. This discrepancy may reflect delayed detection or varying classification criteria among vendors. The SSL certificate issued by Let's Encrypt further complicates analysis, as legitimate certificates are frequently abused to lend credibility to phishing sites. While the domain's IPFS-based hosting via dweb.link is not inherently malicious, it provides threat actors with decentralized, resilient infrastructure that can be difficult to takedown. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where email credential theft poses a significant risk. Monitoring for connections to 209.94.90.2 or requests to the domain's path may help identify compromised endpoints. Given the domain's active status and the presence of a plausible login interface, organizations should also assess whether any users have interacted with the site and initiate password resets or additional authentication measures if necessary. The use of Cloudflare and IPFS infrastructure suggests the threat actor may reuse this hosting setup for future campaigns, warranting broader scrutiny of similar domains.