bafkreiemq3unlavdpaukq5tmpshnass4cuyqrq3cu2af7ibtf7tuzxz4li[.]ipfs[.]dweb[.]link

Analysis of the domain identified by the IPFS content identifier bafkreiemq3unlavdp indicates a high-risk phishing infrastructure still active as of July 12, 2026. The domain resolves to 209.94.90.3 and is served via Cloudflare, utilizing HTTP/3 and a Let's Encrypt SSL certificate issued on May 15, 2026. Registration details point to CSC Corporate Domains, Inc. as the registrar. The domain is currently listed on three security blocklists, including PhishDestroy, OISD, and BLP-Malware, and is flagged by 19 of 95 security vendors in a recent scan. The page title returned is '400 Bad Request,' which may indicate either a misconfigured or intentionally obfuscated phishing endpoint. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. Infrastructure analysis reveals the use of decentralized storage (IPFS) to host the malicious content, a tactic increasingly observed in phishing campaigns to evade takedowns and complicate attribution. The combination of Cloudflare and IPFS suggests an attempt to leverage legitimate services for resilience and anonymity. While the exact nature of the phishing content remains unconfirmed due to the 400 error, the domain's presence on multiple blocklists and the detection count provide concrete evidence of malicious intent. Defenders should treat this domain as an active threat. Network-level blocking is recommended based on the IP address, domain, and associated content identifier. Further investigation into related IPFS hashes and resolving IPs may uncover additional infrastructure linked to this campaign. Given the use of decentralized hosting, monitoring for new content identifiers or subdomains associated with this threat actor is advised.