bafybeia5w6ij6k5e2i3vwagaacosirdjz6kce4q3y2thlqdaqcfnictzmu[.]ipfs[.]dweb[.]link

The domain bafybeia5w6ij6k5e2i3vwagaacosirdjz6kce4q3y2thlqdaqcfnictzmu.ipfs.dweb.link is active as of 12 July 2026 and is classified as a high‑risk brand‑impersonation campaign targeting the cryptocurrency project berachain. Infrastructure analysis shows the domain resolves to the IPv6 address 2602:fea2:2::3, which belongs to AS40680 (Protocol Labs) located in the United States. DNS is hosted on Cloudflare with the authoritative nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the site serves a valid Let’s Encrypt certificate (E7). The site redirects with HTTP 301 and leverages IPFS, Cloudflare, HTTP/3, and third‑party libraries including jsDelivr, crypto‑js, and cdnjs. Reputation services assign a Scamadviser score of 20/100 and a Gridinsoft score of 0/100, and the domain appears on three security blocklists. It is currently blocked by PhishDestroy, ScamSniffer, and Enkrypt. Registration details indicate the domain was created on 24 February 2017 through CSC Corporate Domains, Inc. The page title returned by the server is "Home | Berachain," confirming the intended brand target. No additional content has been observed beyond the title, so the exact phishing or malicious payload remains unknown. Defenders should continue to block the domain across network and endpoint controls, monitor for any associated IPFS hash activity, and consider adding the domain to internal deny lists. Ongoing observation is advised to detect any future changes in payload or hosting infrastructure.