bafkreifoduewvnaxldwyjk6d76fejsbywkfjuvd3khjw7a5rl65xjypqqa[.]ipfs[.]dweb[.]link

This domain, bafkreifoduewvnaxldwyjk6d76fejsbywkfjuvd3khjw7a5rl65xjypqqa.ipfs.dweb.link, is flagged as a high-risk generic phishing threat. Registered on February 24, 2017, through CSC Corporate Domains, Inc., the domain remains active and is currently resolving to the IP address 209.94.90.3, hosted under Protocol Labs in the US. Infrastructure analysis reveals Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) and an SSL certificate issued by Let's Encrypt. The domain is accessible via HTTP/3 and leverages IPFS technology, which is often exploited for decentralized phishing operations due to its resistance to takedowns. As of July 12, 2026, the domain returns an HTTP 200 status but displays a '400 Bad Request' page title, suggesting either misconfiguration or intentional obfuscation of its malicious content. It appears on at least one security blocklist and has been flagged by 17 of 91 security vendors in a recent scan, indicating broad detection as malicious. The exact nature of the phishing content remains unconfirmed, as no specific brand, scam type, or phishing kit has been identified in available data. Defenders should treat this domain as active and high-risk, particularly given its use of IPFS and Cloudflare, which may complicate mitigation efforts. Recommended actions include blocking the domain at the DNS or network level, monitoring for related IPFS hashes, and investigating any connections to the resolving IP (209.94.90.3) in logs or traffic data.