bafybeiaoulkqm54mkpjy5t7idjlc2wxddyj7a4cpdrpi4reejwkd4gphke[.]ipfs[.]dweb[.]link

The domain bafybeiaoulkqm54mkpjy5t7idjlc2wxddyj7a4cpdrpi4reejwkd4gphke.ipfs.dweb.link is currently active and has been identified as a generic phishing operation. Infrastructure analysis shows the domain resolves to the IP address 209.94.90.3, which is hosted in the United States and belongs to AS40680 (Protocol Labs). The site is served through Cloudflare, using HTTP/3, and the authoritative nameservers are clarissa.ns.cloudflare.com and tate.ns.cloudflare.com. A Let’s Encrypt certificate (Issuer: E7) secures the HTTPS connection, but the HTTP response returns a 301 redirect, indicating a possible attempt to forward visitors to a malicious landing page.

The page title observed is "Lets GOU! – Goummunity Takeover," offering no additional context about the spoofed brand or content. Registrant information lists CSC Corporate Domains, Inc. as the registrar, and the domain was originally created on 24 February 2017, suggesting long‑term reuse of the namespace. Reputation signals are poor: Scamadviser assigns a trust score of 20 out of 100, and the domain appears on two security blocklists (PhishDestroy and ScamSniffer).

VirusTotal analysis reports 12 of 91 scanning engines flag the domain, reinforcing the malicious classification. While the exact phishing payload or credential‑harvesting mechanism remains unverified, the convergence of a low trust score, multiple vendor detections, and blocklist listings provides strong evidence of malicious intent. Defenders should block the domain at network perimeter, update URL filtering and threat intelligence feeds, and monitor for any related activity originating from the same IP or Cloudflare edge. Continuous re‑evaluation is advised, as the site may evolve its tactics or host additional malicious content.