bafybeie6jt5ozesxlg26liilufkica2irdmqbw7tk73p5bsnyt4cneetrq[.]ipfs[.]dweb[.]link

Analysis of the domain bafybeie6jt5ozesxlg26liilufkica2irdmqbw7tk73p5bsnyt4cneetrq.ipfs.dweb.link shows a clear brand‑impersonation campaign targeting OneDrive. The site resolves to IP 209.94.90.3, an address owned by AS40680 (Protocol Labs) located in the United States. DNS is served by Cloudflare (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com) and the HTTP response is a 410 Gone, indicating the content has been removed or the host is no longer serving pages. The TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a free, automated certificate.

The page title returned by the server is “OneDrive”, matching the declared brand target. Scamadviser assigns a trust score of 1 / 100, and the domain is listed on a single security blocklist and has been blocked by PhishDestroy. VirusTotal records show 12 of 95 scanned security vendors flagging the domain, providing independent confirmation of malicious intent. The domain was created on 24 February 2017 and is registered through CSC Corporate Domains, Inc. The site employs Cloudflare’s HTTP/3 protocol.

Evidence points to a brand‑impersonation payload rather than a broader phishing infrastructure; however, the exact malicious content is not available because the site is offline and returns HTTP 410. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any future activity, and update detection rules to flag any reuse of the same certificate or Cloudflare configuration. Ongoing observation of the IP range owned by Protocol Labs is advised, as the infrastructure could be repurposed for related campaigns.