bafkreidpjfnryqk3cnzlvf3cuelz6cu2hf5ggwxvuehve5ssjg5oiiytwi[.]ipfs[.]dweb[.]link

The domain bafkreidpjfnryqk3cnzlvf3cuelz6cu2hf5ggwxvuehve5ssjg5oiiytwi.ipfs.dweb.link was observed hosting a page titled "EmailLogin" and is classified as a credential phishing site. Infrastructure analysis shows the domain resolves to the IP address 209.94.90.3, which is assigned to AS40680 belonging to Protocol Labs in the United States. The site is fronted by Cloudflare, as indicated by the authoritative nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and serves content over HTTP/3.

The TLS certificate is issued by Let’s Encrypt (certificate identifier E8). An HTTP request to the site returned a 410 Gone status, and the service is currently reported as offline. VirusTotal records indicate that 18 of 91 scanning engines flagged the domain, reinforcing the malicious assessment.

The domain was created on 24 February 2017 and is registered through CSC Corporate Domains, Inc. It appears on one known blocklist and has been specifically added to PhishDestroy’s deny list. While the page content could not be retrieved due to the offline state, the combination of the page title, credential‑phishing classification, and security vendor detections provides sufficient confidence to treat the domain as malicious. Defenders should block the domain and its associated IP address at perimeter and DNS layers, continue monitoring for any re‑activation, and update threat‑intel feeds with the observed indicators.