bafybeids32ox432igs5e4nk6fc6juvvuj4tdossnwegpsq7sefoipipwve[.]ipfs[.]dweb[.]link

The domain bafybeids32ox432igs5e4nk6fc6juvvuj4tdossnwegpsq7sefoipipwve.ipfs.dweb.link was observed as a generic phishing infrastructure and is currently offline as of the report date, July 24, 2026. Technical analysis shows the site was served through Cloudflare’s network, employing HTTP/3 and using the nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. The TLS certificate was issued by Let’s Encrypt (E7), indicating a valid HTTPS endpoint at the time of capture. HTTP responses returned a 410 Gone status with the page title explicitly showing "410 Gone," confirming that the content has been removed or is no longer accessible.

The domain resolves to IP address 209.94.90.2, which belongs to AS40680 (Protocol Labs) and is geolocated in the United States. Registration records list CSC Corporate Domains, Inc. as the registrar, and the domain creation date is recorded as February 24, 2017. Threat intelligence indicates that the domain was flagged by ten of ninety‑five VirusTotal scanners, and it appears on a single security blocklist. It was also blocked by the PhishDestroy mitigation service, reinforcing its classification as a phishing host.

The elevated risk rating reflects the combination of its historical phishing use, the presence of multiple detection vendor alerts, and its association with Cloudflare infrastructure that can obscure attribution. Uncertainty remains regarding any active payload or credential‑stealing pages because the site now returns a 410 status, and no additional page content has been captured. Defenders should continue to block the domain at network perimeter devices, ensure that any cached DNS entries are purged, and monitor for re‑registration attempts. Ongoing vigilance is recommended for any future resolution of the IP address or reuse of the Cloudflare nameservers, as these could indicate a revival of the phishing operation.