bafkreiackahjsbfnc2ncov3pef52rrtqs5i2bdmfpm4ranevpvg6d34u64[.]ipfs[.]dweb[.]link

The domain bafkreiackahjsbfnc2ncov3pef52rrtqs5i2bdmfpm4ranevpvg6d34u64.ipfs.dweb.link is currently active and classified as a high‑risk generic_phishing infrastructure. HTTP probing returns a 200 status code and the page title is reported as "EmailLogin", indicating a credential‑phishing landing page. Registration data shows the domain was created on May 15, 2026 through CSC Corporate Domains, Inc., and it resolves to IP address 209.94.90.2, which geolocates to the United States and is associated with Protocol Labs. The site is served over TLS using a Let’s Encrypt certificate (issuer E8) and relies on Cloudflare nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0/100, VirusTotal records 18 of 92 security vendors flagging the domain, and it appears on one security blocklist. PhishDestroy has already blocked the domain. No additional content analysis is available beyond the page title, so the exact phishing lure and targeted brands remain unknown. Defenders should immediately block the domain and its resolving IP at perimeter and DNS filtering layers, monitor for related IP or name‑server activity, and consider sinkholing the IP to disrupt traffic. Ongoing telemetry collection is advised to capture any future payloads or credential harvesting mechanisms associated with this infrastructure.