bafybeidfyreuh4x3vxuhzumv4scybbadvpv67sp75wq6uf7biwisavqvnu[.]ipfs[.]dweb[.]link

The domain bafybeidfyreuh4x3vxuhzumv4scybbadvpv67sp75wq6uf7biwisavqvnu.ipfs.dweb.link was observed on two independent phishing blocklists—PhishDestroy and ScamSniffer—and is currently listed as offline with an HTTP 410 response code. DNS resolution points to IP 209.94.90.2, which is registered to AS40680 (Protocol Labs) and appears to be hosted in the United States. The authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, indicating that the infrastructure is serviced through Cloudflare, with HTTP/3 support detected.

The site’s SSL certificate is issued by Let’s Encrypt (E7), and the page title returned during the brief scan was “Magpie XYZ.” Registration data shows the domain was created on 24 February 2017 via CSC Corporate Domains, Inc., and a Scamadviser trust score of 1 out of 100 was recorded. A VirusTotal analysis involved 95 scanning engines, none of which flagged the domain as malicious; however, the lack of detections does not constitute a safety assurance. The combination of blocklist listings, a low trust score, and the presence of a generic page title suggests the domain was used for a generic phishing campaign, though the exact payload or targeted brand remains unverified.

Uncertainties include the content that was served before the 410 status was applied and whether the domain may be re‑registered or the IP reused for future abuse. Defensive actions should include adding the domain and its resolving IP to deny‑list rules, monitoring for any re‑appearance in DNS queries or TLS handshakes, and correlating logs for connections to Cloudflare’s edge nodes serving this hostname. Continuous threat‑intel feeds should be consulted for any resurgence of the domain on additional blocklists or detection platforms.