bafybeieppcmmshlcnlffkhlsrabpgrqcj6z6jtpjux6mqkmwvx2hnvgqmi[.]ipfs[.]dweb[.]link

The domain bafybeieppcmmshlcnlffkhlsrabpgrqcj6z6jtpjux6mqkmwvx2hnvgqmi.ipfs.dweb.link has been identified as a generic phishing gateway operating on the InterPlanetary File System (IPFS) distributed web infrastructure. This domain currently maintains an offline status but was previously classified as an elevated-risk threat targeting users through deceptive content delivery. No specific brand impersonation has been confirmed; however, the domain exhibits characteristics consistent with credential harvesting and malicious payload distribution via IPFS gateways. Analysis indicates the domain was flagged by 14 of 95 security vendors on VirusTotal, a notable detection rate for distributed web content. Registered through CSC Corporate Domains, Inc. on February 24, 2017, the domain resolves to the IP address 209.94.90.2, hosted within the United States under AS40680 (Protocol Labs). The domain appears on two independent security blocklists: PhishDestroy and PhishingDB. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (serial number E7), which, while providing encryption, does not validate the legitimacy of the hosted content. The page title, /ipfs/bafybeieppcmmshlcnlffkhlsrabpgrqcj6z6jtpjux6mqkmwvx2hnvgqmi/, corresponds to the IPFS content identifier, a common pattern in phishing campaigns leveraging decentralized storage. Current status confirms the domain has been taken offline; however, the underlying IPFS content identifier (CID) may remain accessible through alternative gateways or peer nodes. Organizations and users are advised to block the CID bafybeieppcmmshlcnlffkhlsrabpgrqcj6z6jtpjux6mqkmwvx2hnvgqmi at the network perimeter and endpoint levels. Security teams should monitor for attempts to rehost the same content via other IPFS gateways or traditional domains. Updating endpoint detection rules to include the CID and associated IP address (209.94.90.2) is recommended. Given the persistent nature of IPFS-hosted content, continuous monitoring of distributed web infrastructure is advised to detect potential resurfacing of this phishing material.