bafybeiehgfy5gxgf7mv34zs3kih7iatowo7n46jifuwsdozbpi23wnp64u[.]ipfs[.]dweb[.]link

This domain, bafybeiehgfy5gxgf7mv34zs3kih7iatowo7n46jifuwsdozbpi23wnp64u.ipfs.dweb.link, was observed hosting a generic phishing page identified by the path '/ipfs/bafybeiehgfy5gxgf7mv34zs3kih7iatowo7n46jifuwsdozbpi23wnp64u/'. The site is currently offline and returns HTTP 410, indicating the resource has been permanently removed. DNS resolution points to IP 209.94.90.3, which belongs to AS40680 Protocol Labs in the United States. The domain is delegated to Cloudflare name servers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, and the service was delivering content over HTTP/3.

TLS termination is performed by a Let's Encrypt certificate issued to the E7 organization. Reputation data shows a Scamadviser trust score of 1 out of 100 and the domain appears on one public security blocklist. VirusTotal analysis recorded 11 detections out of 95 scanning engines, and the domain is also listed by PhishDestroy. Registration details indicate the domain was created on 24 February 2017 through CSC Corporate Domains, Inc. The page title observed matches the IPFS path and no additional branding or scam‑type metadata is available.

Uncertainty remains around the specific phishing campaign, target audience, and whether the IPFS content was ever actively used for credential harvesting, as the site is no longer serving content. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the IPFS hash in other URLs, and add the associated IP address to outbound deny lists. Ongoing threat‑intel feeds should be consulted for any new indicators tied to the same IPFS hash or to the Cloudflare name servers, and any internal logs containing requests to the domain should be investigated for possible exposure.