bafkreiga6px3lueaki24tsx4oi7kdavctjkxpiobmcqllnr2duqahghtoa[.]ipfs[.]dweb[.]link

The domain bafkreiga6px3lueaki24tsx4oi7kdavctjkxpiobmcqllnr2duqahghtoa.ipfs.dweb.link was registered on 15 May 2026 and resolves to the IP address 209.94.90.3, an address owned by Protocol Labs in the United States. DNS resolution is handled by Cloudflare name servers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com). The site is served over HTTPS using a Let’s Encrypt certificate (E8) and supports HTTP/3. Automated analysis detected the presence of IPFS infrastructure and Cloudflare services. The HTTP response code returned was 200, while the page title reported by crawlers is “400 Bad Request”, indicating that the payload may be intentionally mis‑directed or that the endpoint is currently inactive. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal flags the domain in 16 of 92 scanners. It is listed on a single external blocklist and has already been blocked by PhishDestroy. The classification as a high‑risk generic phishing threat is based on the combination of low trust scores, multiple vendor detections, and the use of IPFS‑linked URLs, which are commonly leveraged for credential‑harvesting pages. No concrete evidence of a phishing landing page or credential‑capture form has been observed; the content remains unverified beyond the title. Defenders should immediately block the domain and the associated IP address at perimeter firewalls, update URL filtering and IDS/IPS signatures to include the full hostname and its IP, and monitor for any related IPFS hash references. Continuous re‑evaluation is advised, as the site may become active and host malicious payloads at any time.