bafybeiexp6feeuazq3jeglcrz4t7524kr7ewiovi7re7g7fb3pg3sl5xkm[.]ipfs[.]dweb[.]link

The domain bafybeiexp6feeuazq3jeglcrz4t7524kr7ewiovi7re7g7fb3pg3sl5xkm.ipfs.dweb.link is currently offline and returns HTTP status code 410, indicating that the resource has been permanently removed. It is protected by a Let’s Encrypt certificate (issue identifier E7) and is served through Cloudflare, which also enables HTTP/3 support. DNS resolution points to the IP address 209.94.90.2, an address owned by AS40680 Protocol Labs and geolocated to the United States. The domain was first created on February 24, 2017 and was registered via CSC Corporate Domains, Inc. Nameserver delegation uses clarissa.ns.cloudflare.com and tate.ns.cloudflare.com.

The site’s page title, as captured before takedown, reads “Initia App,” but no further content analysis is available. Reputation data shows the host appears on two security blocklists and is specifically blocked by PhishDestroy and ScamSniffer, reflecting its classification as a generic phishing infrastructure. VirusTotal scans registered seven detections out of ninety‑five participating vendors, reinforcing the malicious assessment.

While the offline status limits active probing, the combination of a permanent “gone” HTTP response, Cloudflare fronting, and presence on dedicated phishing blocklists suggests the domain was previously used for credential‑harvesting or fraudulent credential submission. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor the associated IP address for any re‑use, and ensure that any residual indicators (such as the page title “Initia App”) are incorporated into threat‑intel feeds. Ongoing observation of the registrar and hosting ASN is advisable to detect potential resurrection or related domain registrations.