bafkreidjo3pjfqei63cdnraoeltvorqxnhkvcjiuy4bfth43ghrove3rmq[.]ipfs[.]dweb[.]link

This domain, bafkreidjo3pjfqei63cdnraoeltvorqxnhkvcjiuy4bfth43ghrove3rmq.ipfs.dweb.link, is flagged as an active high-risk credential phishing threat. Analysis indicates the domain was created on April 26, 2026, and currently resolves to the IP address 209.94.90.3, hosted under Protocol Labs in the United States. The page title, 'EmailLogin,' suggests the site is designed to harvest email credentials, aligning with the classified scam type of credential phishing. Infrastructure analysis reveals the use of IPFS for content distribution, Cloudflare for DNS and likely traffic proxying, and HTTP/3 for communication, which may complicate detection and takedown efforts. Security vendors have detected malicious activity associated with this domain, with 21 of 91 engines on VirusTotal flagging it as malicious. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and does not provide additional indicators of compromise. Nameservers are hosted under Cloudflare, further obscuring the origin of the threat. Defenders should prioritize blocking this domain at the DNS and network level, as it remains active and poses a direct risk to users. While the exact content and targeted brands are not yet analyzed, the combination of IPFS hosting, Cloudflare infrastructure, and a credential phishing classification indicates a sophisticated and persistent threat. Further investigation into associated IP addresses and certificate chains may reveal additional linked infrastructure.