bafkreia2pngndebebyscsmxex5zjszaf5sdg3xso2ugg63rrsv3qqgwumu[.]ipfs[.]dweb[.]link

The domain bafkreia2pngndebebyscsmxex5zjszaf5sdg3xso2ugg63rrsv3qqgwumu.ipfs.dweb.link was created on February 24, 2017 and is currently registered through CSC Corporate Domains, Inc. DNS resolution points to the single IPv4 address 209.94.90.3, and the authoritative name servers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. VirusTotal reports that 18 of 91 security vendors have flagged the domain, confirming that a notable portion of the security community considers it malicious. The domain is actively listed on two public blocklists and is specifically blocked by PhishDestroy and OpenPhish, reinforcing its classification as a high‑risk phishing infrastructure.

Its status remains active as of the report date, July 26, 2026, and no evidence of takedown or remediation has been observed. Defenders should treat any traffic to this host as hostile. Immediate mitigation steps include adding the domain and its resolving IP (209.94.90.3) to network deny lists, updating DNS sinkhole configurations, and ensuring endpoint protection solutions ingest the latest blocklist entries from PhishDestroy and OpenPhish.

Continuous monitoring of Cloudflare name‑server activity may reveal additional sub‑domains or related infrastructure. Because the public evidence does not include details such as SSL certificates, HTTP response codes, or page content, analysts should consider active probing in a controlled environment to gather further indicators while maintaining isolation. Until more granular indicators are uncovered, the recommended baseline response is to block the domain at perimeter and endpoint layers, alert SOC staff of its high‑risk status, and correlate any internal logs that reference the IP or domain with existing detection rules.