bafkreidrtssvtbombehtu2s6pqpmwz5a6cuep5nrlwvyfcknofsvoe2eoq[.]ipfs[.]dweb[.]link

The domain bafkreidrtssvtbombehtu2s6pqpmwz5a6cuep5nrlwvyfcknofsvoe2eoq.ipfs.dweb.link is currently active and classified as a high‑risk generic phishing threat. Registration data shows the domain was created on February 24, 2017 and is registered through CSC Corporate Domains, Inc. The site resolves to IP address 209.94.90.3, which is located in the United States and is associated with Protocol Labs. Network analysis indicates the presence of Cloudflare services and HTTP/3 support, while the underlying content is served via IPFS, as reflected in the page title "IPFS Service Worker Gateway | HEAD@572bc4a". An SSL certificate issued by Let’s Encrypt (E8) secures the connection. The domain is listed on a single security blocklist and has been blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 18 of 91 security vendors flag the domain as malicious. The scam type is identified as brand impersonation, though the specific brand being mimicked is not disclosed in the available intelligence. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the associated IP address, and consider adding the domain to local blocklists. Additional investigation of the hosted IPFS content is recommended to determine the exact phishing payload and any potential victim targeting.