bafybeihxp3cmskdb4nr76bocjhdgq32ykbfquxwakbdx33iehf44jxwuim[.]ipfs[.]dweb[.]link

On August 03, 2026 the domain bafybeihxp3cmskdb4nr76bocjhdgq32ykbfquxwakbdx33iehf44jxwuim.ipfs.dweb.link was identified as part of an active generic phishing infrastructure and assigned an elevated risk rating. The domain is currently listed as blocked by the PhishDestroy mitigation service, indicating that at least one reputable anti‑phishing sinkhole has taken action to prevent traffic from reaching the host. VirusTotal analysis shows that 14 of 91 security vendors have flagged the domain as malicious, providing a moderate consensus of detection across independent scanning engines.

Additionally, the domain appears on a single external security blocklist, further confirming that external threat‑intel feeds consider it a threat vector. The available intelligence does not disclose details such as the underlying IP address, hosting provider, SSL certificate status, or HTTP response codes, and no page title or brand attribution has been published. Consequently, the exact payload or credential‑harvesting mechanism remains unknown, and the precise targeting profile cannot be derived from the current data set.

Defenders should add the full domain to network perimeter blocklists, DNS‑sinkhole the name, and monitor for any outbound connections to the IPFS‑linked address. Continuous re‑evaluation is advised, as further analysis or additional vendor detections may surface new indicators of compromise. Organizations employing email filtering should treat any messages containing links to this domain as malicious, and incident response teams should be prepared to investigate potential credential exposure if users have interacted with the URL.