bafybeidyjhvudof62jn7o6746utfllknvl4kx5wgemf6iorsmigz3lzvja[.]ipfs[.]dweb[.]link

Analysis of the domain bafybeidyjhvudof62jn7o6746utfllknvl4kx5wgemf6iorsmigz3lzvja.ipfs.dweb.link shows a high‑risk brand impersonation campaign targeting WalletConnect. The site presents a page titled "WalletConnect: The onchain UX ecosystem — WalletConnect," a clear indication of deliberate brand alignment. The domain is served over HTTPS using a Let’s Encrypt certificate issued under the E7 profile, which does not mitigate the malicious intent. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal scans flag the domain on 15 of 95 security engines, reinforcing the malicious classification.

Network analysis places the resolved address 209.94.90.2 within the United States and maps it to AS40680 owned by Protocol Labs, a provider commonly used for IPFS hosting. Registration records list CSC Corporate Domains, Inc. as the registrar, and the domain has been active since February 24, 2017, indicating long‑term infrastructure reuse. DNS is hosted on Cloudflare, with nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the service advertises HTTP/3 capability. An HTTP 301 redirect is observed, but the final landing page retains the WalletConnect‑related title.

The domain appears on two public blocklists and is actively blocked by PhishDestroy and ScamSniffer, confirming community recognition of its abusive nature. While the exact payload or credential‑harvesting mechanism remains unknown without direct content inspection, the convergence of brand‑specific title, multiple vendor detections, low trust score, and blocklist presence provides sufficient evidence for a high‑risk rating. Defenders should update URL filtering, block the IP address 209.94.90.2, and add the full domain to threat intelligence feeds.