bafybeielizhnh2kfpdv2iivhqh4ttf4kqfecv2qyislghqacr6n5gzcfzm[.]ipfs[.]dweb[.]link

The domain bafybeielizhnh2kfpdv2iivhqh4ttf4kqfecv2qyislghqacr6n5gzcfzm.ipfs.dweb.link is currently offline, returning an HTTP 410 Gone response. Infrastructure analysis shows it resolves to IP address 209.94.90.2, which is assigned to AS40680 (Protocol Labs) and geolocated in the United States. The domain is served through Cloudflare, using Cloudflare’s nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and supports HTTP/3. TLS is provided by a Let’s Encrypt certificate (issuer E7), indicating a valid HTTPS endpoint despite the site’s offline status.

Registration data reveals the domain was created on 24 February 2017 via CSC Corporate Domains, Inc., but no recent renewal information is available. The page title retrieved from the last known snapshot is "Vana - The First Network for User-Owned Data and Decentralized AI," which does not correspond to any known legitimate brand and appears unrelated to the observed threat vector. Reputation signals are poor: Scamadviser assigns a trust score of 10 out of 100, and the domain appears on two security blocklists (PhishDestroy and ScamSniffer). VirusTotal analysis shows that one of ninety‑five scanning engines flagged the domain, providing additional confirmation of malicious intent.

The primary uncertainty is the actual content and phishing payload, as the site is no longer serving pages, preventing a detailed content‑level assessment. Defenders should block both the domain and its resolved IP address at perimeter and DNS layers, monitor for any re‑registration or resurrection of the host, and incorporate the observed indicators (Cloudflare nameservers, Let’s Encrypt TLS, HTTP 410 status, and the specific page title) into threat‑intel feeds. Continuous re‑query of passive DNS and certificate transparency logs is advised to detect potential reuse of the IP or certificate by other malicious actors.