bafkreiew7fbnac76pnq2nkw5you7mrwbzcgmgdb664vklfxmjb75p2xq2e[.]ipfs[.]dweb[.]link

Analysis of the domain bafkreiew7fbnac76pnq2nkw5you7mrwbzcgmgdb664vklfxmjb75p2xq2e.ipfs.dweb.link shows a consistent pattern of malicious activity associated with generic phishing. The domain was created on February 24, 2017 and is registered through CSC Corporate Domains, Inc. Infrastructure inspection reveals that the hostname resolves to the IPv4 address 209.94.90.2, a server that is currently listed on at least one security blocklist. The same host is also flagged by PhishDestroy, indicating that it has been identified as part of a phishing infrastructure.

VirusTotal scans have returned 20 positive detections out of 91 security vendors, confirming that a notable portion of commercial scanners consider the domain malicious. No additional public intelligence such as Safe Browsing verdicts, OTX entries, SSL certificate details, HTTP response codes, or page‑title information is available at this time, so the exact content served by the site remains unverified. Defenders should treat the domain as high‑risk: block any outbound connections to the address 209.94.90.2, add the full hostname to DNS‑based blocklists, and monitor for any internal use of the domain in authentication workflows.

Continuous re‑evaluation is advised, especially if new telemetry surfaces from sandbox analysis or if the domain begins to appear in further vendor feeds. Until more contextual evidence emerges, the precautionary stance is to deny traffic to this host and to include it in existing phishing detection rules.