bafkreibgunu3g3olaciceqy2lcx2jucgwevhiy7lnevfgeedl5waktqvk4[.]ipfs[.]dweb[.]link

Analysis of the domain bafkreibgunu3g3olaciceqy2lcx2jucgwevhiy7lnevfgeedl5waktqvk4.ipfs.dweb.link indicates a high-risk credential phishing operation active as of July 12, 2026. The domain, hosted on IPFS infrastructure, resolves to 209.94.90.2 (AS40680, Protocol Labs) and presents a page titled 'Sign in - Professional Email,' suggesting a focus on harvesting corporate or professional email credentials. Eighteen of ninety-four security vendors on VirusTotal have flagged this domain, corroborating its malicious classification. Infrastructure analysis reveals the use of Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com) and technologies including Backbone.js, Underscore.js, jQuery, and HTTP/3. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., though its malicious use appears to be a more recent development. The SSL certificate is graded E7, and the domain remains unblocked by most security providers, with only one known blocklist currently listing it. Defenders should prioritize blocking this domain at the DNS and network layers, particularly in enterprise environments where professional email credentials are targeted. The use of IPFS and Cloudflare may complicate takedown efforts, necessitating coordination with hosting providers and certificate authorities. Further investigation into associated IP addresses and SSL certificates is recommended to identify related infrastructure. The exact phishing kit or brand impersonation remains unconfirmed, but the page title aligns with credential harvesting campaigns.