bafybeieioorq2gemlvbkffwwttxkijnn7lb3kjh4rbvh223jb5qrzesgqa[.]ipfs[.]dweb[.]link

The domain bafybeieioorq2gemlvbkffwwttxkijnn7lb3kjh4rbvh223jb5qrzesgqa.ipfs.dweb.link was created on November 29, 2021 and is currently resolved to the IP address 209.94.90.2, which belongs to AS40680 owned by Protocol Labs in the United States. Infrastructure analysis shows the site is served through Cloudflare, using the nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the connection is protected by a Let’s Encrypt certificate (E7). The HTTP response returns status code 200 and the page title is the raw IPFS path "/ipfs/bafybeieioorq2gemlvbkffwwttxkijnn7lb3kjh4rbvh223jb5qrzesgqa/", confirming the presence of IPFS and HTTP/3 technologies.

Reputation data indicates a Gridinsoft trust score of 0 out of 100, and the domain is listed on at least one public blocklist. VirusTotal scans have flagged the domain by 16 of 93 security vendors, and the domain is actively blocked by PhishDestroy. The registrar listed is CSC Corporate Domains, Inc. While the evidence confirms a high‑risk generic phishing classification, the specific payload or targeted brand has not been disclosed in the available intelligence, leaving the exact phishing vector uncertain.

Defenders should block the IP address 209.94.90.2 at network perimeters, add the domain to URL filtering policies, and monitor for any DNS queries to the associated sub‑domain. Continuous re‑scanning with multi‑engine services is recommended to capture any new malicious indicators, and any observed traffic should be logged for forensic correlation with broader phishing campaigns.