bafybeifn4q7vghs7f3xwilosxa4dyllaadejgevezprlqf5cgs5mgpvmr4[.]ipfs[.]dweb[.]link

This domain, hosted on the InterPlanetary File System (IPFS) gateway dweb.link, is currently flagged as an active generic phishing threat targeting users under the page title 'Vertex'. Infrastructure analysis reveals the domain resolves to the IP address 209.94.90.3, associated with AS40680 (Protocol Labs) in the United States. The domain was registered on February 24, 2017, through CSC Corporate Domains, Inc., and employs Cloudflare nameservers (clarissa.ns.cloudflare.com and tate.ns.cloudflare.com) alongside HTTP/3 support, indicating modern infrastructure designed to evade detection or blocking attempts. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated nature. A 301 HTTP status code suggests the domain may redirect visitors to another location, though the final destination remains unconfirmed. Security vendor detections are minimal but notable: one of ninety-five vendors on VirusTotal has flagged the domain, while two independent blocklists (PhishDestroy and ScamSniffer) have explicitly blocked it. Scamadviser assigns a trust score of 1 out of 100, reinforcing the high-risk classification. The exact nature of the phishing content is not yet analysed, as no brand target or scam type is specified in available data. The page title 'Vertex' may refer to a legitimate entity, but without further evidence, this cannot be confirmed. Defenders should treat this domain as a generic phishing threat, particularly given its persistence since at least early 2026 and its use of IPFS, which complicates takedown efforts. Network-level blocking of the IP 209.94.90.3 and Cloudflare nameservers may mitigate exposure, though monitoring for redirects or evolving infrastructure is recommended. No cryptocurrency wallet addresses, payment gateways, or specific lures have been identified in the provided intelligence.