bafkreihsuuo6vix5kfhmegstaombmlrre3emy57mnwniobfaez7ks2o63a[.]ipfs[.]dweb[.]link

The domain bafkreihsuuo6vix5kfhmegstaombmlrre3emy57mnwniobfaez7ks2o63a.ipfs.dweb.link was registered on April 25, 2026 through CSC Corporate Domains, Inc. and uses Cloudflare nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. Infrastructure analysis shows it resolves to IP 209.94.90.2, an address owned by Protocol Labs in the United States. The site presents an HTTP/3 service over a valid Let's Encrypt certificate (E8) and returns HTTP 200 with the page title "EmailLogin". VirusTotal scans indicate that 22 of 94 security vendors flagged the domain, and it appears on one security blocklist. The domain is currently active and has been blocked by PhishDestroy. Detected technologies include IPFS and Cloudflare, consistent with the IPFS‑hosted dweb.link subdomain. The risk rating is high and the threat type is classified as generic phishing aimed at credential harvesting. Defenders should add the IP address 209.94.90.2 to outbound filtering rules, monitor DNS queries for the full domain and its IPFS sub‑domain, and enforce strict email authentication to mitigate credential‑phishing attempts. Continuous re‑evaluation is advised, as detection counts may increase and additional intelligence could emerge.