bafkreieoefpotxbvczooyf6pvwlyqnpakmmyzvjnv6l6pyyx2tnmw4pcpu[.]ipfs[.]dweb[.]link

Analysis of the domain bafkreieoefpotxbvczooyf6pvwlyqnpakmmyzvjnv6l6pyyx2tnmw4pcpu.ipfs.dweb.link shows an elevated‑risk generic phishing indicator set on July 24, 2026. The site was registered on February 21, 2026 through CSC Corporate Domains, Inc. and is hosted behind Cloudflare, as evidenced by the authoritative nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. Cloudflare’s support for HTTP/3 is observed, and the TLS certificate is issued by Let’s Encrypt (E7). DNS resolution returns the IPv6 address 2602:fea2:2::3, which belongs to AS40680 owned by Protocol Labs and is geolocated to the United States.

HTTP requests return a 410 Gone status code and the page title is exactly "410 Gone," indicating that the content has been removed or taken offline. The domain appears on one security blocklist and is specifically flagged by PhishDestroy. VirusTotal scans report that 18 of 93 security vendors have flagged the domain, reinforcing the phishing classification.

While the current HTTP response suggests the site is no longer serving malicious content, the historical presence on blocklists, the certificate profile, and the vendor detections imply that the infrastructure was previously used for phishing campaigns. Defenders should continue to block the domain at DNS and proxy layers, monitor any future DNS changes that could reactivate the host, and consider adding the IP address 2602:fea2:2::3 to network‑level deny lists. Ongoing vigilance is advised because the underlying hosting environment (Cloudflare) can be repurposed for new malicious payloads if the attacker regains control of the domain or deploys a new sub‑resource under the same address space.