bafybeifoqx7cecgwyuti2e5fmxrvkx7veb3rjeodscfspaorccswaqkjla[.]ipfs[.]dweb[.]link

The domain bafybeifoqx7cecgwyuti2e5fmxrvkx7veb3rjeodscfspaorccswaqkjla.ipfs.dweb.link was observed hosting a Yahoo‑brand credential phishing page that returned HTTP 410 before being taken offline. Registration data shows the domain was created on 24 February 2017 and is registered through CSC Corporate Domains, Inc. The authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com, indicating use of Cloudflare’s DNS and edge services. Network analysis reveals the domain resolves to the IPv6 address 2602:fea2:2::2, which is announced by AS40680 (Protocol Labs) and geolocated to the United States. An SSL certificate issued by Let’s Encrypt (E7) was present, confirming the site served HTTPS traffic. Technical fingerprinting detected Cloudflare and HTTP/3 support, consistent with the observed infrastructure.

Reputation checks flag the site as highly untrustworthy: Scamadviser assigns a trust score of 1 / 100, and VirusTotal reports that 11 of 95 scanned security vendors flagged the domain as malicious. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy, reinforcing its classification as a credential‑phishing vector targeting Yahoo users. The page title captured during the scan was simply "Yahoo," matching the declared brand target.

Because the site is currently offline (HTTP 410) no further payload or page content can be examined, and the exact phishing kit or credential‑collection mechanism remains unknown. Defenders should continue to monitor the associated IP range and Cloudflare edge nodes for re‑use, update URL‑filtering and email‑security policies to block any future resolves of this domain or its sibling subdomains, and consider adding the domain to internal blocklists. Threat‑intel consumers are advised to correlate any observed Yahoo‑login attempts with this indicator and to treat related traffic as malicious until proven benign.