bafybeiftpudgealc6un26lsfm6drgk3kbn2bbpet6pkfbdaty4homsff5e[.]ipfs[.]dweb[.]link

The domain bafybeiftpudgealc6un26lsfm6drgk3kbn2bbpet6pkfbdaty4homsff5e.ipfs.dweb.link is flagged as an elevated‑risk generic phishing site. Infrastructure analysis shows the name resolves to IP address 209.94.90.2, which belongs to AS40680 operated by Protocol Labs in the United States. The hosting provider is Cloudflare, as indicated by the presence of Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and the detection of HTTP/3 support. The site served a Let's Encrypt certificate (E7) before being taken offline, returning an HTTP 410 status code, confirming the content is no longer available.

Reputation services have rated the domain extremely poorly: Scamadviser assigns a trust score of 1 out of 100, and the domain appears on two independent blocklists, PhishDestroy and ScamSniffer. VirusTotal reports that seven of ninety‑five scanning engines flagged the domain, reinforcing the malicious assessment. The page title captured during the brief availability period was "2024 BEDROCK SECURITY COMPROMISE: Check If You're Affected | Revoke.cash," suggesting the phishing lure targeted users of the Revoke.cash service. Registration data indicates the domain was created on 24 February 2017 through CSC Corporate Domains, Inc., a registrar known to host a variety of legitimate and illicit sites.

While the exact phishing payload or credential‑stealing mechanism has not been recovered, the combination of a low trust score, multiple vendor detections, and blocklist listings provides sufficient confidence to classify the domain as a malicious phishing infrastructure. Defenders should continue to block the domain at perimeter devices, update URL filtering and threat‑intel feeds, and monitor for any resurgence of the same IP or similar subdomains. Analysts should also watch for new domains registered by the same registrar that reference Revoke.cash or similar keywords, as threat actors may reuse this naming pattern for future campaigns.