bafkreidwdybc7dlcr3vbbuqme4joydimyoryfqv3lc7cci3xmxbcmwt2qm[.]ipfs[.]dweb[.]link

This domain, bafkreidwdybc7dlcr3vbbuqme4joydimyoryfqv3lc7cci3xmxbcmwt2qm.ipfs.dweb.link, is flagged as a high-risk credential phishing threat. Analysis indicates the site presents an 'EmailLogin' page title, suggesting an attempt to harvest user credentials. The domain remains active as of July 12, 2026, and is currently listed on one security blocklist. Infrastructure analysis reveals it resolves to IP 209.94.90.2, hosted by Protocol Labs in the US, and uses Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com). The domain was registered on May 11, 2026, through CSC Corporate Domains, Inc., and employs a Let's Encrypt SSL certificate (E8). The HTTP status returns 200, confirming the site is accessible. Eighteen of ninety-one security vendors on VirusTotal have detected this domain as malicious. Defenders should treat this domain as an active phishing threat, block resolution at the DNS level, and monitor for credential submission attempts originating from this infrastructure. The exact content and targeted brand are not yet confirmed, but the page title and scam classification indicate a focus on credential theft.