bafkreiazgua7fj5axsfrzcu6bht5kgstvntc7ktrapw6f3g5bqziiznohq[.]ipfs[.]dweb[.]link

Analysis indicates that the domain bafkreiazgua7fj5axsfrzcu6bht5kgstvntc7ktrapw6f3g5bqziiznohq.ipfs.dweb.link is actively serving a high-risk credential phishing threat as of July 12, 2026. The domain, registered on May 6, 2026, resolves to the IP address 209.94.90.3, hosted by Protocol Labs in the United States. Infrastructure analysis reveals Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com), a configuration commonly observed in phishing campaigns to obscure origin and evade takedowns. The page title, EmailLogin, suggests an intent to harvest credentials, aligning with the classified scam type of credential phishing. The domain is flagged by 21 of 91 security vendors, indicating a consensus on its malicious nature, and is currently blocked by at least one security blocklist. The SSL certificate, issued by Let's Encrypt (serial E8), provides encryption but does not validate legitimacy, a tactic frequently exploited in phishing operations. While the exact content and targeted brand remain unconfirmed due to lack of direct analysis, the combination of infrastructure, naming conventions, and vendor detections strongly supports the classification as an active phishing endpoint. Defenders are advised to treat this domain as hostile and implement blocking measures at the DNS, IP, and certificate levels. Further investigation into associated IP ranges and certificate issuance patterns may reveal additional related threats.