bafkreiap7ms7viqgm6zki3cw4g4ytvohem7mfvr4gk3gnjfvgmjhpvqu4y[.]ipfs[.]dweb[.]link

The domain bafkreiap7ms7viqgm6zki3cw4g4ytvohem7mfvr4gk3gnjfvgmjhpvqu4y.ipfs.dweb.link is flagged as an elevated‑risk generic phishing infrastructure. DNS resolution points to the IP address 209.94.90.3, and the domain is served by Cloudflare name servers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. Registration records show the domain was created on 24 February 2017 and was registered through CSC Corporate Domains, Inc. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal scans indicate that 17 of 91 security vendors have flagged the domain as malicious, reinforcing the elevated risk assessment. No additional public intelligence such as SSL certificate details, HTTP response codes, Safe Browsing status, or page title information is currently available, leaving the payload or target brand unconfirmed.

Defenders should prioritize adding the domain and its resolving IP (209.94.90.3) to network and DNS blocklists, monitor for any DNS queries to the associated Cloudflare name servers, and apply existing phishing detection rules that reference the observed vendor detections. Continuous re‑scanning on platforms like VirusTotal is advised to capture any changes in vendor consensus, and security operations should consider correlating this indicator with endpoint telemetry to detect potential exploitation attempts.