bafkreiezyyuwkx6lx4ibhwdclgzdmqqi4o6lbn3h7hjc2mh3o3ms2zxb4q[.]ipfs[.]dweb[.]link

This domain, bafkreiezyyuwkx6lx4ibhwdclgzdmqqi4o6lbn3h7hjc2mh3o3ms2zxb4q.ipfs.dweb.link, is flagged as an active high-risk credential phishing threat. Registered on April 26, 2026, it remains operational as of July 12, 2026, with a page title of 'EmailLogin,' suggesting a focus on harvesting email credentials. Infrastructure analysis reveals the domain resolves to 209.94.90.2 and uses Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com), alongside a Let's Encrypt SSL certificate (E8). The site is hosted on IPFS, a decentralized storage network often exploited for phishing due to its resilience and difficulty to takedown, and supports HTTP/3, which may complicate detection or mitigation efforts. The domain appears on one security blocklist, and 17 of 91 security vendors on VirusTotal have flagged it, indicating a consensus on its malicious nature. While the exact brand or service being impersonated is not confirmed, the 'EmailLogin' page title and credential phishing classification imply a generic email credential harvesting scheme. Defenders should treat this domain as a confirmed threat and prioritize blocking it at the DNS, proxy, or firewall level. Given the use of IPFS and Cloudflare, traditional takedown requests may be less effective, so monitoring for related infrastructure (e.g., IP addresses, SSL certificates, or additional domains sharing the same nameservers) is recommended to disrupt associated phishing campaigns. The domain's continued activity and lack of widespread blocklisting suggest it may still be in an early or targeted phase of deployment.