bafybeifpqhyzn73oe4u5fepceonr6hbpvffuxj7vikwnwh3wkrp2v3blei[.]ipfs[.]dweb[.]link

PhishDestroy identifies elevated-risk phishing impersonating a generic brand via the IPFS-hosted domain bafybeifpqhyzn73oe4u5fepceonr6hbpvffuxj7vikwnwh3wkrp2v3blei.ipfs.dweb.link. The domain is currently active and poses a credible threat to users interacting with IPFS gateways or decentralized web services. This infrastructure masquerades as legitimate content while harvesting credentials or delivering malicious payloads under the guise of a trusted brand. Security teams should treat this domain as a high-confidence phishing indicator and block all associated traffic immediately.

This domain was flagged by 18 of 95 VirusTotal vendors, blocked by OISD, and resolves to IP 209.94.90.2. Registered through CSC Corporate Domains, Inc., the domain was created on February 24, 2017, and appears on one security blocklist. Its SSL certificate, issued by Let's Encrypt, maintains a deceptive appearance of legitimacy despite its malicious purpose. These technical indicators, combined with its persistent hosting on IPFS infrastructure, highlight the sophistication of this phishing campaign and its ability to evade traditional detection methods. The domain's age and registrar choice suggest deliberate long-term positioning within trusted IPFS ecosystems.

The current status of this IPFS phishing domain remains active, and users are strongly advised against interacting with any content linked to this endpoint. Organizations should immediately block the domain at the network level and inspect gateway logs for signs of compromise. Security teams are urged to audit IPFS-related traffic and distribute threat intelligence to prevent downstream exploitation. Additionally, users should verify all IPFS content through trusted sources and avoid entering credentials into untrusted interfaces. Proactive monitoring and user education remain critical in mitigating the risks posed by this sophisticated phishing infrastructure.