bafkreifboouw4pecx3v2v6wldkrbkaywjpzmwts3juhhn54dvai6esmlma[.]ipfs[.]dweb[.]link

This domain is flagged as a high-risk generic credential phishing threat. It resolves to IP 209.94.90.2, located in the United States under Protocol Labs, and was created on April 11, 2026. The page title is 'Webmail', indicating a likely login credential harvesting target, though the specific brand or service being impersonated has not been identified. The domain uses Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and is registered through CSC Corporate Domains, Inc. with a Let's Encrypt SSL certificate (serial E8). It currently returns HTTP status 200 and remains active. VirusTotal shows 19 of 94 security vendors flagging the domain, and it appears on two security blocklists (PhishDestroy and PhishingDB). Gridinsoft trust score is 0/100. Defenders should treat this domain as actively hostile: block all outbound traffic to it, inspect any email or messages referencing the domain, and monitor for compromised credentials if users may have been exposed. The exact page content beyond the title has not been analyzed, so the specific brand or lure used is uncertain. No other infrastructure details such as ASN, hosting provider, or associated phishing kit are available in the current intelligence.