bafybeihkqxli7rn4yzsjh3zws5jdrmorjdo3zjivditajb6tkzq73e7ona[.]ipfs[.]dweb[.]link

This domain, bafybeihkqxli7rn4yzsjh3zws5jdrmorjdo3zjivditajb6tkzq73e7ona.ipfs.dweb.link, is currently flagged as a generic phishing threat under active investigation as of July 12, 2026. Infrastructure analysis reveals the domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.2, hosted on AS40680 (Protocol Labs) in the United States. The domain employs Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and presents an HTTP 301 redirect, though the final destination remains unconfirmed. The page title 'Dinero' suggests a potential financial or monetary theme, but the exact content and target of the phishing campaign have not yet been fully analyzed. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and has received consistently low trust scores (0/100 from Gridinsoft and 1/100 from Scamadviser). Despite these indicators, no detections were recorded by the 95 vendors that previously scanned the domain, though this absence does not confirm safety. The SSL certificate is issued by Let's Encrypt (serial number E7), and the site utilizes Cloudflare and HTTP/3 technologies. Defenders should treat this domain as a potential threat, particularly given its presence on multiple blocklists and low trust scores. Monitoring for further detections or changes in infrastructure (e.g., IP resolution, nameserver updates) is recommended. If the domain is encountered in logs or network traffic, it should be blocked or investigated further, as the campaign remains active and its exact nature is still under review.