bafkreicohl4bjtxbxh7srnvwbuayrctjspzatbtjudnbirrg3snjujrkna[.]ipfs[.]dweb[.]link

Analysis indicates that the domain bafkreicohl4bjtxbxh7srnvwbuayrctjspzatbtjudnbirrg3snjujrkna.ipfs.dweb.link is actively serving a generic phishing page titled EmailLogin. The domain resolves to IP address 209.94.90.2 and was registered through CSC Corporate Domains, Inc. on June 15, 2026. Infrastructure reveals the use of IPFS for hosting, with Cloudflare providing network services and HTTP/3 support. The SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of legitimate or malicious sites. Security vendor detections are present but not unanimous: 18 of 95 engines on VirusTotal flag the domain as malicious. The domain appears on three security blocklists, including PhishDestroy and OISD, and has been assigned a trust score of 0/100 by Gridinsoft. The exact content of the phishing page has not been fully analyzed, but the page title suggests an attempt to harvest email credentials. Defenders should note that the domain remains active as of July 12, 2026. The use of IPFS and Cloudflare may complicate takedown efforts and attribution. Network-level blocking of the IP 209.94.90.2 and domain-based filtering are recommended mitigations. Further investigation into the hosting provider and registrar may yield additional indicators of compromise or infrastructure reuse across campaigns.