bafkreidg7dhaupuit4wc2i7w22mphyqnlsp6cvp6gplvh7w4t25hmip24q[.]ipfs[.]dweb[.]link

This domain, bafkreidg7dhaupuit4wc2i7w22mphyqnlsp6cvp6gplvh7w4t25hmip24q.ipfs.dweb.link, is flagged as a high-risk credential phishing threat. Analysis indicates it is actively resolving to 209.94.90.2 (AS40680, Protocol Labs, US) and returning HTTP 200 status. The page title 'EmailLogin' suggests a generic email credential harvesting attempt, though the exact brand or service being mimicked is not yet confirmed. Infrastructure reveals Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com) and Let's Encrypt SSL certificate (E8). The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and is currently listed on one security blocklist. Seventeen of ninety-one security vendors on VirusTotal detect this domain as malicious. Technologies observed include IPFS, Cloudflare, and HTTP/3. Defenders should treat this domain as an active phishing endpoint, block resolution at DNS and IP levels, and monitor for credential submission attempts originating from internal networks. No evidence of a specific phishing kit or targeted brand is present in available data.