gateway[.]ipfs[.]io

Analysis as of July 24, 2026 shows that gateway.ipfs.io is actively operating a brand impersonation campaign targeting the foundation brand. The site returns an HTTP 301 redirect and presents the page title "About the IPFS.io Public Gateway," which does not reference the impersonated brand, suggesting the malicious content may be hosted elsewhere or delivered after redirection. Infrastructure observations reveal the domain resolves to IP address 185.199.110.153, located in the United States and associated with ASN 54113 (Fastly, Inc.). The domain is served through Cloudflare nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the hosting stack includes Hugo, Varnish, GitHub Pages, and Fastly, indicating a content delivery network configuration commonly abused for rapid content distribution.

The SSL certificate is issued by Google Trust Services under the WE1 designation, providing a valid TLS chain that may lend credibility to the site. Registry data shows the domain was created on May 16, 2014 and is registered through CSC Corporate Domains, Inc., a registrar frequently observed in legitimate and malicious registrations. Reputation metrics are unfavorable: Gridinsoft assigns a trust score of 39 out of 100, and the domain appears on one known security blocklist. VirusTotal analysis reports nine of ninety‑five scanners flagging the domain, reinforcing the suspicion of malicious intent.

PhishDestroy has also blocked the domain, confirming its classification as a brand impersonation vector. While the exact phishing page or credential harvesting mechanism has not been captured, the combination of a valid TLS certificate, reputable CDN infrastructure, and a misleading page title constitutes a credible threat that can bypass basic URL filtering. Defenders should block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP range, and update endpoint protection signatures to include the observed VirusTotal detections.