bafkreiekbtzmshtc237taav2aevej2xm7rbnt5f4vkc5vavwijjg44m7vi[.]ipfs[.]dweb[.]link

This domain is flagged as a high-risk brand impersonation threat targeting Network Solutions. The domain is hosted on the InterPlanetary File System (IPFS) network via dweb.link, resolving to IP 209.94.90.2 in the United States (AS40680 Protocol Labs). It was registered on February 24, 2017, through CSC Corporate Domains, Inc., and uses Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com). The page title is 'Sign in - Professional Email', consistent with a credential phishing operation impersonating Network Solutions' email login portal. The domain is currently active, serving HTTP status 200, and uses a Let's Encrypt SSL certificate (E7). Security analysis shows 19 of 95 vendors on VirusTotal flagging the domain as malicious. Google Safe Browsing lists it under SOCIAL_ENGINEERING. It appears on two security blocklists (PhishDestroy and PhishingDB). Trust scores are critically low: Gridinsoft 0/100 and Scamadviser 1/100. Technologies detected include Backbone.js, Underscore.js, jQuery, Cloudflare, and HTTP/3. What remains uncertain is the full scope of the phishing campaign, including whether the domain is actively harvesting credentials or redirecting victims. Defenders should block the domain at the DNS and web gateway levels, add the IP 209.94.90.2 to threat intelligence feeds, and monitor for similar IPFS-hosted phishing domains using the same infrastructure pattern. Users who may have entered credentials should reset passwords immediately and enable multi-factor authentication.