bafybeidfgwggshi5syqnklufswynx2u6rumuvgp4jl6n4lbqsolbeshdga[.]ipfs[.]dweb[.]link

Analysis of the domain bafybeidfgwggshi5syqnklufswynx2u6rumuvgp4jl6n4lbqsolbeshdga.ipfs.dweb.link shows a high‑risk generic phishing operation targeting cryptocurrency users. The domain is registered through CSC Corporate Domains, Inc. and was created on February 24, 2017. It is served via Cloudflare, using the nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the site responds with an HTTP 301 redirect. The TLS certificate is issued by Let’s Encrypt (E7), indicating a legitimate certificate authority but not mitigating the malicious intent.

The underlying IP address resolves to 209.94.90.3, an address owned by AS40680 Protocol Labs in the United States, confirming the hosting infrastructure. Technical fingerprints include Cloudflare’s edge network and support for HTTP/3, which are typical for fast content delivery but do not provide any protective value here. Reputation data lists a Scamadviser trust score of 20 out of 100 and classifies the scam as a crypto‑related phishing attempt. The domain appears on two independent blocklists—PhishDestroy and ScamSniffer—and has been flagged by four of ninety‑five VirusTotal scanners, reinforcing the suspicion of malicious activity.

The page title observed is “Usual,” offering no additional context about the payload. While the available evidence confirms the domain’s active status and its association with a crypto phishing campaign, the specific payload, landing page behavior, and victim interaction details remain unknown. Defenders should block the domain and its resolving IP at perimeter and DNS filters, monitor for any outbound connections to the IP, and consider adding the domain to internal blacklists. Continuous observation of the hosting infrastructure and periodic re‑scans with updated threat‑intelligence feeds are recommended to detect any evolution of the campaign.