bafkreiglcas6juu7h3aqnkeexw47ramujsvoyukagzxbdqnch26nirscvy[.]ipfs[.]dweb[.]link

This domain, bafkreiglcas6juu7h3aqnkeexw47ramujsvoyukagzxbdqnch26nirscvy.ipfs.dweb.link, is actively flagged as a high-risk credential phishing threat. Analysis indicates the domain was created on February 24, 2017, and currently resolves to IP address 209.94.90.2, hosted on AS40680 (Protocol Labs) in the United States. The infrastructure employs Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and leverages IPFS for content delivery, utilizing HTTP/3 protocol. The SSL certificate is issued by Let's Encrypt (serial E8), a common choice for both legitimate and malicious domains. The domain is present on one security blocklist and is flagged by 19 of 91 security vendors on VirusTotal as malicious, specifically for credential phishing. The page title, '400 Bad Request,' suggests either a misconfigured or intentionally obfuscated landing page, though the exact content and targeted brand remain unconfirmed. No specific phishing kit or brand target is identified in available intelligence. Defenders should treat this domain as an active threat. The combination of IPFS hosting, Cloudflare infrastructure, and a low trust score (0/100) aligns with patterns observed in credential harvesting campaigns. Network-level blocking is recommended, particularly for organizations where credential theft poses a critical risk. Further analysis of the page content is required to determine the exact phishing mechanism or targeted entity, though the domain's classification as a credential phishing threat is supported by multiple security vendors.