bafkreic5tvubv22nqg24xjzksdmyk4mzmlbfs4yc72w4fsxbf734fzjphm[.]ipfs[.]dweb[.]link

This domain, identified as bafkreic5tvubv22.ipfs.dweb.link, is classified as a generic phishing threat designed to harvest user credentials or sensitive information. Analysis of the page title, 400 Bad Request, suggests an attempt to mimic server errors or misconfigurations, a tactic often used to deceive users into engaging with malicious content. No specific brand impersonation or crypto drainer kit signatures were detected in initial scans, though the infrastructure aligns with common phishing delivery mechanisms observed in distributed web environments. Technical indicators reveal a VirusTotal detection score of 20 out of 95 security vendors, indicating moderate consensus on its malicious nature. The domain was registered through CSC Corporate Domains, Inc., and resolves to the IP address 209.94.90.2. Created on May 15, 2026, the domain leverages Let's Encrypt SSL certificates and is hosted on IPFS, with Cloudflare and HTTP/3 technologies facilitating content delivery. It appears on two security blocklists and is actively blocked by PhishDestroy and OISD. No Google Safe Browsing (GSB) flags were reported at the time of analysis. The domain is currently offline, reducing immediate exposure risk. However, the underlying infrastructure remains a potential threat vector, particularly given its use of decentralized hosting and reputable CDN services to evade detection. Organizations and users are advised to maintain blocklist updates and monitor for reactivation attempts. Endpoint protection should be configured to flag domains with similar IPFS-based patterns or registrar histories, as these are frequently exploited in phishing campaigns. Continuous monitoring of DNS resolutions and SSL certificate issuances for this registrar is recommended to preempt future threats.