bafybeigdc66io3yev7awofrteoyay6ghsx2jzqebhsim4sza26bvwm7ytq[.]ipfs[.]dweb[.]link

This domain, bafybeigdc66io3yev7awofrteoyay6ghsx2jzqebhsim4sza26bvwm7ytq.ipfs.dweb.link, is flagged as an active high-risk brand impersonation threat targeting Revolut. Infrastructure analysis reveals the domain is hosted on IPFS and resolves to 2602:fea2:2::2, with Cloudflare nameservers (clarissa.ns.cloudflare.com, tate.ns.cloudflare.com) and a Let's Encrypt SSL certificate. The domain was created on February 24, 2017, and is registered through CSC Corporate Domains, Inc. Despite its age, it currently serves a page titled 'CARV - Modular Data Layer for Gaming and AI,' which does not align with the targeted brand, suggesting either misdirection or a compromised legitimate resource repurposed for phishing. Security vendors flag this domain, with 10 out of 95 detections on VirusTotal, and it appears on two security blocklists (PhishDestroy, ScamSniffer). The HTTP 301 redirect indicates potential redirection to another malicious endpoint, though the final destination remains unconfirmed. Technologies detected include IPFS, Google Tag Manager, Cloudflare, and HTTP/3, which may be leveraged to evade detection or track victims. Defenders should treat this domain as active and high-risk. Immediate actions include blocking resolution at the DNS level, monitoring for connections to the associated IP (2602:fea2:2::2), and investigating any internal access attempts. The discrepancy between the page title and the impersonated brand warrants further analysis to determine if this is a phishing kit, a compromised IPFS resource, or part of a broader campaign. Given the domain's age and infrastructure, retrospective log analysis may identify prior compromise activity.