bafybeicakljrcne7ikzpdmshde2j5kof5arq2ywfu3j7vzutwmub32mgrq[.]ipfs[.]dweb[.]link

The domain bafybeicakljrcne7ikzpdmshde2j5kof5arq2ywfu3j7vzutwmub32mgrq.ipfs.dweb.link is currently active and serves a page titled “Naver Sign in”. HTTP probing returns a 200 status code, confirming the site is reachable. Infrastructure analysis shows the domain resolves to IP 209.94.90.3, which belongs to AS40680 (Protocol Labs) and is hosted in the United States. The domain is registered through CSC Corporate Domains, Inc. and was created on February 24 2017. DNS resolution is handled by Cloudflare nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the site presents a valid Let’s Encrypt certificate (E7).

Technical footprint includes IPFS, Bootstrap, jQuery, Google Hosted Libraries, Cloudflare services, and HTTP/3 support. Threat intelligence flags the site as a credential‑phishing operation that impersonates Facebook, targeting users with a brand‑specific lure. VirusTotal analysis records 18 detections out of 95 scanned vendors, indicating a strong consensus among security products that the domain is malicious. Additional signals include a Gridinsoft trust score of 0 / 100, placement on one external blocklist, and explicit blocking by PhishDestroy.

Google Safe Browsing categorises the URL as social engineering, reinforcing the phishing assessment. While the page title references “Naver”, no further content analysis is available, leaving the exact visual or functional mimicry unconfirmed. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and update intrusion‑detection signatures with the observed SSL fingerprint and HTTP/3 characteristics. Continuous re‑scanning on VirusTotal and inclusion in reputable blocklists are recommended to maintain coverage as the threat evolves.