bafkreiantz253x2tbmykf6iwibochazhc57kqc6tyjukz6e5fz5uxchg3m[.]ipfs[.]dweb[.]link

This domain is flagged as an active credential-phishing site targeting email login credentials. Analysis indicates the domain leverages IPFS (InterPlanetary File System) infrastructure, resolving to IP address 209.94.90.2 under AS40680 (Protocol Labs) in the United States. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and currently employs Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) alongside HTTP/3 protocol support. The page title, 'EmailLogin,' aligns with the credential-phishing classification, though the exact content and targeted brand remain unconfirmed due to limited forensic analysis. Infrastructure review reveals the domain is actively resolving with an HTTP 200 status and holds a Gridinsoft trust score of 0/100. It appears on one security blocklist and is explicitly blocked by PhishDestroy. Seventeen of ninety-one security vendors on VirusTotal have flagged the domain, though this detection count reflects only a subset of available engines and should not be interpreted as exhaustive. The SSL certificate is issued by Let's Encrypt (serial number E8), a common but not inherently malicious provider. Defenders should prioritize this domain for immediate blocking at the network perimeter, particularly in environments where email credential harvesting poses a critical risk. Given the use of IPFS—a decentralized storage network—traditional takedown mechanisms may prove ineffective, necessitating reliance on DNS filtering, endpoint protection rules, or web gateway policies. The domain's long registration history does not mitigate its current malicious status, as phishing operators frequently repurpose older domains to evade reputation-based defenses. No evidence suggests this campaign targets a specific sector, but organizations handling sensitive email credentials should treat this as a high-risk indicator.