bafybeif5xdzxzkk6hpdngckqqt4qfejabreu6fkzi4rwsnuk733woz2spu[.]ipfs[.]dweb[.]link

The domain bafybeif5xdzxzkk6hpdngckqqt4qfejabreu6fkzi4rwsnuk733woz2spu.ipfs.dweb.link is flagged as a high‑risk generic phishing site as of July 24 2026. Infrastructure analysis shows the domain is served by Cloudflare’s DNS (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and resolves to IP 209.94.90.3, an address located in the United States and assigned to AS40680 (Protocol Labs). The web server presents a Let’s Encrypt/E7 certificate and responds with HTTP 301 redirects, while the underlying protocol stack includes HTTP/3 support.

The page title retrieved from the surface scan is “Silo Finance | Secure Money Markets for all Crypto Assets,” suggesting an attempt to lure users interested in crypto‑related financial services. The domain appears on two reputable phishing blocklists, PhishDestroy and ScamSniffer, confirming its inclusion in active threat feeds. VirusTotal reports that one of ninety‑five scanning engines flagged the domain, adding a single independent detection to the evidence set.

Registration data indicates the domain was created on February 24 2017 and is owned through CSC Corporate Domains, Inc. No further content analysis is available beyond the title, leaving the exact malicious payload and lure mechanisms unverified. Defenders should block the domain and its resolved IP at perimeter and DNS layers, monitor for related traffic to the Cloudflare edge, and consider adding the associated IP to threat intelligence feeds. Continuous re‑scanning of the URL and coordination with the listed blocklist operators are advised to capture any evolution of the phishing campaign.