bafybeieupax7fljy3xxi5l3ss6wq7wuohq3p2xfb3g756udlmxoslgxjpy[.]ipfs[.]dweb[.]link

The domain bafybeieupax7fljy...ipfs.dweb.link is currently classified as a high‑risk brand‑impersonation threat targeting the Across brand. Infrastructure analysis shows the domain resolves to IP 209.94.90.3, which belongs to AS40680 (Protocol Labs) in the United States. The site is served over HTTPS using a Let's Encrypt certificate (E7) and is protected by Cloudflare, with HTTP/3 enabled and an HTTP 301 redirect in place. Nameservers clarissa.ns.cloudflare.com and tate.ns.cloudflare.com are observed. The page title returned by the server is “Clip Finance | Home”, and the domain was created on 24 February 2017 through CSC Corporate Domains, Inc. Google Safe Browsing lists the domain under the Social engineering category, and the site is blocked by MetaMask, ScamSniffer, PhishDestroy, and SEAL. VirusTotal reports that 10 of 95 security vendors flag the domain, and it appears on two external blocklists. The domain remains active as of the report date. While the exact phishing payload or credential‑stealing mechanisms have not been disclosed, the combination of brand‑impersonation labeling, malicious blocklist presence, and multiple security vendor detections indicates a credible threat. Defenders should block the domain at the network perimeter, update URL filtering policies, and monitor DNS queries for the resolved IP. Continuous scanning of the host for malicious activity and removal of any related client‑side extensions is advised.