ipfs[.]netlify[.]app

This domain, ipfs.netlify.app, is actively engaged in phishing operations targeting users of the InterPlanetary File System (IPFS) by impersonating official Chinese-language development documentation. Analysis indicates the site employs brand impersonation tactics, likely designed to harvest credentials or distribute malicious payloads under the guise of legitimate IPFS resources. The page title, 'IPFS中文开发文档,' directly mimics authentic documentation, increasing the likelihood of deception among developers and users seeking technical references. Infrastructure analysis reveals concrete technical indicators of compromise. The domain resolves to IP address 98.84.224.111, hosted on Amazon Web Services (AS14618), and was registered on February 21, 2026, through Name.com, Inc., under Netlify’s infrastructure. VirusTotal detection metrics show 3 out of 95 security vendors flagging the domain as malicious. The domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, and is secured with a DigiCert Global G2 TLS RSA SHA256 2020 CA1 SSL certificate, which may lend a false sense of legitimacy to unsuspecting visitors. As of the latest assessment, ipfs.netlify.app remains active and poses a high risk to users. The domain’s infrastructure and impersonation tactics suggest it is part of a broader campaign targeting cryptocurrency or developer communities. Immediate mitigation actions include blocking the domain at the network level, updating endpoint protection rules to include the resolved IP, and alerting users to verify documentation sources through official IPFS channels. Despite existing blocklist entries, the domain’s continued operation underscores the need for heightened vigilance and proactive monitoring of similar impersonation schemes.