bafkreig6tzr6377vzh4wol64vl5jzhrylmvnewmcnh6qgktrmv6owuzxu4[.]ipfs[.]dweb[.]link

This domain, bafkreig6tzr6377vzh4wol64vl5jzhrylmvnewmcnh6qgktrmv6owuzxu4.ipfs.dweb.link, is an active credential phishing threat hosted on the InterPlanetary File System (IPFS) and proxied through Cloudflare. The page title is "EmailLogin," indicating a targeted attempt to harvest email account credentials. The domain was registered on April 24, 2026, through CSC Corporate Domains, Inc., and uses a Let's Encrypt SSL certificate. It resolves to IP address 209.94.90.3, located in the United States and associated with Protocol Labs. VirusTotal analysis shows 21 out of 94 security vendors flagging this domain as malicious. The Gridinsoft trust score is 0/100, and it appears on one security blocklist, including PhishDestroy. The site returns HTTP status 200 and employs HTTP/3. The exact phishing kit or targeted brand is not specified in the available data, but the combination of a generic email login page, IPFS hosting, and high vendor detection rate strongly supports the credential phishing classification. Defenders should block this domain at the DNS and web gateway levels, monitor for any credentials that may have been submitted, and investigate any associated IPFS content or Cloudflare configurations for further malicious infrastructure. The domain remains active as of this report date.