bafybeig34wb2al33emjaaicltbnomje54jbvkrli75l5vbzlq7bo22e3ye[.]ipfs[.]dweb[.]link

This domain, a subdomain under the IPFS gateway dweb.link, is currently flagged as an active phishing threat. Analysis indicates the domain resolves to 209.94.90.2 and presents a 504 Gateway Timeout error, which may suggest either a misconfigured or intentionally obscured backend infrastructure. The domain was registered on February 24, 2017, through a corporate registrar, though its long registration history does not mitigate its current malicious classification. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, which are common among both legitimate services and threat actors seeking to obfuscate traffic or evade detection. The SSL certificate is issued by Let's Encrypt, a neutral indicator that does not inherently confirm malicious intent but is frequently leveraged in phishing campaigns. The domain appears on two security blocklists and is actively blocked by at least two detection systems, reinforcing its classification as a high-risk threat. Security vendors have flagged this domain, with 16 out of 95 engines on a major scanning platform identifying it as malicious. The exact nature of the phishing content remains unconfirmed, as the page title only indicates a gateway error rather than a specific brand or scam type. No concrete evidence links this domain to a particular phishing kit, targeted brand, or scam category at this time. Defenders should treat this domain as an active threat and implement blocking measures at the network or endpoint level. Given its presence on multiple blocklists and the use of IPFS gateway infrastructure, monitoring for related subdomains or similar patterns under dweb.link is recommended. Further analysis of the backend infrastructure may reveal additional indicators of compromise, though the current gateway error limits immediate visibility into the phishing payload.