bafkreihpo6eyonmqzhsnzcqc4iihfxrz453jmf4jxu4gs2q6nd2ms3bska[.]ipfs[.]dweb[.]link

Analysis date: July 29 2026. The domain bafkreihpo6eyonmqzhsnzcqc4iihfxrz453jmf4jxu4gs2q6nd2ms3bska.ipfs.dweb.link is flagged as a generic phishing infrastructure. Registration data shows the name was created on February 24 2017 through CSC Corporate Domains, Inc., indicating a long‑standing registration that predates the observed malicious activity. DNS resolution points to IP address 209.94.90.3, a host that appears on a single public blocklist and is listed as blocked by the PhishDestroy service.

VirusTotal scans have returned 19 positive detections out of 91 submitted security vendors, confirming that multiple antivirus and URL‑filtering engines recognize the host as malicious. The domain is present on one additional security blocklist, reinforcing its reputation as a threat vector. No public evidence from Safe Browsing, Open Threat Exchange, SSL certificate analysis, HTTP response codes, trust‑score services, or page‑title metadata is currently available, leaving those aspects of the infrastructure unconfirmed. The lack of such data does not imply benign behavior; rather, it reflects a gap in publicly shared observations.

Defenders should continue to block the domain at DNS and proxy layers, incorporate the IP 209.94.90.3 into network‑wide deny lists, and monitor for any traffic attempts to the ipfs.dweb.link sub‑domain space. Organizations using web‑filtering solutions should ensure that the 19 VirusTotal detections are mapped to their threat‑intelligence feeds, and security teams should consider adding the domain to internal blacklists until the infrastructure is fully mitigated. Continuous re‑evaluation is advised, as additional indicators such as SSL details or HTTP status may emerge in future scans.