bafkreibawwibszeisgf7jarjpm3p2qeze6nejxl3p2hbioadratcofntgm[.]ipfs[.]dweb[.]link

PhishDestroy identifies the domain bafkreibawwibszeisgf7jarjpm3p2qeze6nejxl3p2hbioadratcofntgm.ipfs.dweb.link as posing an elevated-risk generic phishing threat. The domain is currently active and has been confirmed as a phishing infrastructure used to deceive users into disclosing sensitive information or downloading malware. No specific brand impersonation has been reported in available intelligence, differentiating this case from targeted phishing campaigns. This domain has been flagged by 13 of 95 VirusTotal security vendors, indicating significant suspicion within the cybersecurity community. It was registered through CSC Corporate Domains, Inc., resolves to IP address 209.94.90.3, and was created on February 24, 2017. With a subdomain under the .dweb.link namespace and an SSL certificate issued by Let's Encrypt, the domain exhibits partial legitimacy that could mislead users into trusting its content. The domain remains active and poses a persistent threat to users who may encounter it through malicious links or deceptive redirects. PhishDestroy recommends immediate blocking of the domain and IP address 209.94.90.3 at the network perimeter. Users should avoid accessing the domain and report any encounters to their security teams. Organizations are advised to update firewall rules, DNS sinkholes, and email filtering policies to prevent inbound and outbound connections. Continuous monitoring of this domain and associated infrastructure is critical due to its long-standing presence and active phishing operations. The seed identifier 5c19fd should be used for tracking and correlation with threat intelligence feeds.