bafybeidqp2rvj7tisdarxknqei2iskr4uwtzyrfsghgcdovn3g33i5fube[.]ipfs[.]dweb[.]link

The domain bafybeidqp2rvj7tisdarxknqei2iskr4uwtz... is hosted on an IP address (209.94.90.3) that resolves to a United States location associated with ASN 40680, operated by Protocol Labs. The site presents a valid SSL certificate issued by Let’s Encrypt (E7) and returns an HTTP 301 redirect, indicating an active web service. Infrastructure analysis shows the domain is delegated to Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and leverages HTTP/3, reflecting modern delivery mechanisms. Registration data indicates the domain was created on February 24, 2017 through CSC Corporate Domains, Inc., and the page title observed is "Orbiter". The domain appears on two independent security blocklists, PhishDestroy and ScamSniffer, confirming that external threat‑intel sources have identified it as a malicious resource.

Current intelligence classifies the domain as a generic phishing threat and places its risk level as under investigation. The presence on multiple blocklists, combined with the use of a reputable certificate authority and Cloudflare’s CDN, suggests an attempt to increase credibility and evade simple detection. However, the specific phishing campaign details, such as targeted brands or the nature of the harvested credentials, remain unknown because no additional content analysis has been performed. The lack of detections on VirusTotal does not imply safety; it merely reflects that automated scanners have not yet flagged the payload.

Defenders should prioritize monitoring network traffic to the IP 209.94.90.3 and enforce strict outbound filtering for HTTP/3 connections to this address. Blocking the domain at the DNS layer, especially by adding it to internal blocklists, will prevent user access. Continuous re‑evaluation of the domain’s activity is recommended, as its status is marked active and under investigation, and further indicators may emerge as threat actors evolve the campaign.